Ensure cancellation of animation timer in a detached state.

Source/core/svg/animation/SMILTimeContainer.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 342 matching lines @@
                 break;
             /* fall through */
         case RestartOnceTimer:
             scheduleAnimationPolicyTimer();
             break;
         case CancelOnceTimer:
             cancelAnimationPolicyTimer();
             break;
         }
     }
+    if (policy == ImageAnimationPolicyAllowed) {
+        // When the SVG owner element becomes detached from its document,
+        // the policy defaults to ImageAnimationPolicyAllowed; there's
+        // no way back. If the policy had been "once" prior to that,
+        // ensure cancellation of its timer.
+        if (onceAction == CancelOnceTimer)
+            cancelAnimationPolicyTimer();
+    }
     return true;
 }
 
 void SMILTimeContainer::updateDocumentOrderIndexes()
 {
     unsigned timingElementCount = 0;
     for (SVGSMILElement& element : Traversal<SVGSMILElement>::descendantsOf(m_ownerSVGElement))
         element.setDocumentOrderIndex(timingElementCount++);
     m_documentOrderIndexesDirty = false;
 }
@@ skipping 160 matching lines @@
 }
 
 void SMILTimeContainer::trace(Visitor* visitor)
 {
 #if ENABLE(OILPAN)
     visitor->trace(m_scheduledAnimations);
 #endif
 }
 
 }