Lock animated property type of result animation during processing

third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp

Index: third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
diff --git a/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp b/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
index 6429c840440def0edeac06af55d24b1fc7145d30..f7132e271b717431644dc39a44f67dc698465d1f 100644
--- a/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
@@ -286,6 +286,11 @@ void SVGAnimateElement::clearAnimatedType()
     if (!m_animatedProperty)
         return;
 
+    // The animated property lock is held while we're a result
+    // animation for a animation group. We will very likely crash
+    // later if we clear the animated type while the lock is held.

[sof, 2016/05/19 06:45:44]

mention crbug.com/581546 ?

+    RELEASE_ASSERT(!animatedTypeIsLocked());
+
     SVGElement* targetElement = this->targetElement();
     if (!targetElement) {
         m_animatedProperty.clear();