Do not fire timers for finalizing objects.

Source/platform/Timer.h

 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 95 matching lines @@
 
 #if ENABLE(ASSERT)
     ThreadIdentifier m_thread;
 #endif
 
     friend class ThreadTimers;
     friend class TimerHeapLessThanFunction;
     friend class TimerHeapReference;
 };
 
+template<typename T, bool = IsGarbageCollectedType<T>::value>
+class TimerIsObjectAliveTrait {
+public:
+    static bool isAlive(T*) { return true; }
+};
+
+template<typename T>
+class TimerIsObjectAliveTrait<T, true> {
+public:
+    static bool isAlive(T* objectPointer)
+    {
+        // Oilpan: if a timer fires while Oilpan heaps are being lazily
+        // swept, it is not safe to proceed if the object is about to
+        // be swept (and this timer will be stopped while doing so.)
+        return Heap::isFinalizedObjectAlive(objectPointer);
+    }
+};
+
 template <typename TimerFiredClass>
 class Timer final : public TimerBase {
 public:
     typedef void (TimerFiredClass::*TimerFiredFunction)(Timer*);
 
     Timer(TimerFiredClass* o, TimerFiredFunction f)
         : m_object(o), m_function(f) { }
 
 private:
-    virtual void fired() override { (m_object->*m_function)(this); }
+    virtual void fired() override
+    {
+        if (!TimerIsObjectAliveTrait<TimerFiredClass>::isAlive(m_object))
+            return;
+        (m_object->*m_function)(this);
+    }
 
     // FIXME: oilpan: TimerBase should be moved to the heap and m_object should be traced.
     // This raw pointer is safe as long as Timer<X> is held by the X itself (That's the case
     // in the current code base).
     GC_PLUGIN_IGNORE("363031")
     TimerFiredClass* m_object;
     TimerFiredFunction m_function;
 };
 
 inline bool TimerBase::isActive() const
 {
     ASSERT(m_thread == currentThread());
     return m_nextFireTime;
 }
 
 }
 
 #endif