Delay resetting image animation, if possible.

third_party/WebKit/Source/core/fetch/ImageResource.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
     Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ skipping 186 matching lines @@
 void ImageResource::destroyDecodedDataIfPossible()
 {
     if (!hasClientsOrObservers() && !isLoading() && (!m_image || (m_image->hasOneRef() && m_image->isBitmapImage()))) {
         m_image = nullptr;
         setDecodedSize(0);
     } else if (m_image && !errorOccurred()) {
         m_image->destroyDecodedData();
     }
 }
 
+void ImageResource::doResetAnimation()
+{
+    if (m_image)
+        m_image->resetAnimation();
+}
+
 void ImageResource::allClientsAndObserversRemoved()
 {
-    if (m_image && !errorOccurred())
-        m_image->resetAnimation();
+    if (m_image && !errorOccurred()) {
+        // If possible, delay the resetting until back at the event loop.
+        // Doing so after a conservative GC prevents resetAnimation() from
+        // upsetting ongoing animation updates (crbug.com/613709)
+        if (!ThreadHeap::willObjectBeLazilySwept(this))
+            Platform::current()->currentThread()->getWebTaskRunner()->postTask(BLINK_FROM_HERE, bind(&ImageResource::doResetAnimation, WeakPersistentThisPointer<ImageResource>(this)));
+        else
+            m_image->resetAnimation();
+    }
     if (m_multipartParser)
         m_multipartParser->cancel();
     Resource::allClientsAndObserversRemoved();
 }
 
 void ImageResource::appendData(const char* data, size_t length)
 {
     if (m_multipartParser) {
         m_multipartParser->appendData(data, length);
     } else {
@@ skipping 330 matching lines @@
     if (response().wasFetchedViaServiceWorker())
         return response().serviceWorkerResponseType() != WebServiceWorkerResponseTypeOpaque;
     if (!getImage()->currentFrameHasSingleSecurityOrigin())
         return false;
     if (passesAccessControlCheck(securityOrigin))
         return true;
     return !securityOrigin->taintsCanvas(response().url());
 }
 
 } // namespace blink