Lock animated property type of result animation during processing

third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp

Index: third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
diff --git a/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp b/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
index 6429c840440def0edeac06af55d24b1fc7145d30..fe2e6c2ddaee9d34ff2f5c32d8a55dfcfa1905f2 100644
--- a/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGAnimateElement.cpp
@@ -286,6 +286,11 @@ void SVGAnimateElement::clearAnimatedType()
     if (!m_animatedProperty)
         return;
 
+    // The animated property lock is held for the "result animation" (see SMILTimeContainer::updateAnimations())
+    // while we're processing an animation group. We will very likely crash later if we clear the animated type
+    // while the lock is held. See crbug.com/581546.
+    RELEASE_ASSERT(!animatedTypeIsLocked());
+
     SVGElement* targetElement = this->targetElement();
     if (!targetElement) {
         m_animatedProperty.clear();