Do not fire timers for finalizing objects.

Source/platform/Timer.h

 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 104 matching lines @@
 
 template <typename TimerFiredClass>
 class Timer final : public TimerBase {
 public:
     typedef void (TimerFiredClass::*TimerFiredFunction)(Timer*);
 
     Timer(TimerFiredClass* o, TimerFiredFunction f)
         : m_object(o), m_function(f) { }
 
 private:
-    virtual void fired() override { (m_object->*m_function)(this); }
+    virtual void fired() override
+    {
+        // Oilpan: if a timer fires while Oilpan heaps are being lazily
+        // swept, it is not safe to proceed if the object is dead.
+        // Assume this timer will be stopped once the object is finalized.
+        if (IsGarbageCollectedType<TimerFiredClass>::value && !Heap::isObjectAlive(m_object))
+            return;
+
+        (m_object->*m_function)(this);
+    }
 
     // FIXME: oilpan: TimerBase should be moved to the heap and m_object should be traced.
     // This raw pointer is safe as long as Timer<X> is held by the X itself (That's the case
     // in the current code base).
     GC_PLUGIN_IGNORE("363031")
     TimerFiredClass* m_object;
     TimerFiredFunction m_function;
 };
 
 inline bool TimerBase::isActive() const
@@ skipping 51 matching lines @@
     TimerFiredClass* m_object;
     TimerFiredFunction m_function;
 
     double m_delay;
     bool m_shouldRestartWhenTimerFires;
 };
 
 }
 
 #endif