Ensure cancellation of animation timer in a detached state.

Source/core/svg/animation/SMILTimeContainer.cpp

Index: Source/core/svg/animation/SMILTimeContainer.cpp
diff --git a/Source/core/svg/animation/SMILTimeContainer.cpp b/Source/core/svg/animation/SMILTimeContainer.cpp
index e432c411187a47651b289457e3f8a02ae989f95e..045b445248ae22678b22bd6739877a425fb3b6f1 100644
--- a/Source/core/svg/animation/SMILTimeContainer.cpp
+++ b/Source/core/svg/animation/SMILTimeContainer.cpp
@@ -360,6 +360,14 @@ bool SMILTimeContainer::handleAnimationPolicy(AnimationPolicyOnceAction onceActi
             break;
         }
     }
+    if (policy == ImageAnimationPolicyAllowed) {
+        // When the SVG owner element becomes detached from its document,
+        // the policy defaults to ImageAnimationPolicyAllowed; there's
+        // no way back. If the policy had been "once" prior to that,
+        // ensure cancellation of its timer.
+        if (onceAction == CancelOnceTimer)
+            cancelAnimationPolicyTimer();
+    }
     return true;
 }