SVG: SVGAnimateElement should not cache |m_animatedElements|

Source/core/svg/SVGElement.cpp

Index: Source/core/svg/SVGElement.cpp
diff --git a/Source/core/svg/SVGElement.cpp b/Source/core/svg/SVGElement.cpp
index 80c3c75c9c08040add3acb4a09575860bd5d25b4..4f36f6f4dc71cf95867172da8c0d9e5807b615d6 100644
--- a/Source/core/svg/SVGElement.cpp
+++ b/Source/core/svg/SVGElement.cpp
@@ -1048,28 +1048,33 @@ bool SVGElement::hasFocusEventListeners() const
 
 void SVGElement::invalidateInstances()
 {
-    if (!inDocument())
-        return;
-
     if (instanceUpdatesBlocked())
         return;
 
-    const WillBeHeapHashSet<RawPtrWillBeWeakMember<SVGElement> >& set = instancesForElement();
+    const WillBeHeapHashSet<RawPtrWillBeMember<SVGElement> >& set = instancesForElement();
     if (set.isEmpty())
         return;
 
+    // Take snapshot of the |set|, as it may be be modified from |invalidateShadowTree()|.
+    WillBeHeapVector<RawPtrWillBeWeakMember<SVGElement> > snapshot;
+    copyToVector(set, snapshot);
+
     // Mark all use elements referencing 'element' for rebuilding
-    const WillBeHeapHashSet<RawPtrWillBeWeakMember<SVGElement> >::const_iterator end = set.end();
-    for (WillBeHeapHashSet<RawPtrWillBeWeakMember<SVGElement> >::const_iterator it = set.begin(); it != end; ++it) {
-        (*it)->setCorrespondingElement(0);
+    for (WillBeHeapVector<RawPtrWillBeWeakMember<SVGElement> >::const_iterator it = snapshot.begin(), end = snapshot.end(); it != end; ++it) {
+        SVGElement* element = *it;
+        if (!element)
+            continue;
+
+        element->setCorrespondingElement(0);
 
-        if (SVGUseElement* element = (*it)->correspondingUseElement()) {
-            ASSERT(element->inDocument());
-            element->invalidateShadowTree();
+        if (SVGUseElement* useElement = element->correspondingUseElement()) {
+            ASSERT(useElement->inDocument());
+            useElement->invalidateShadowTree();
         }
     }
 
-    document().updateRenderTreeIfNeeded();
+    if (inDocument())
+        document().updateUseShadowTreesIfNeeded();
 }
 
 SVGElement::InstanceUpdateBlocker::InstanceUpdateBlocker(SVGElement* targetElement)