Do not fire timers for finalizing objects.

Source/platform/Timer.h

Index: Source/platform/Timer.h
diff --git a/Source/platform/Timer.h b/Source/platform/Timer.h
index 58d96925a3673d41573c07d2b4229131645b83ad..54360dddb4f4582f419dec7ab4d1263d9bfbc615 100644
--- a/Source/platform/Timer.h
+++ b/Source/platform/Timer.h
@@ -122,7 +122,16 @@ public:
         : m_object(o), m_function(f) { }
 
 private:
-    virtual void fired() override { (m_object->*m_function)(this); }
+    virtual void fired() override
+    {
+        // Oilpan: if a timer fires while Oilpan heaps are being lazily
+        // swept, it is not safe to proceed if the object is dead.
+        // Assume this timer will be stopped once the object is finalized.
+        if (IsGarbageCollectedType<TimerFiredClass>::value && !Heap::isFinalizedObjectAlive(m_object))
+            return;
+
+        (m_object->*m_function)(this);
+    }
 
     // FIXME: oilpan: TimerBase should be moved to the heap and m_object should be traced.
     // This raw pointer is safe as long as Timer<X> is held by the X itself (That's the case