Keep SVGImage alive across its animation timer callback.

Source/core/svg/graphics/SVGImageChromeClient.cpp

 /*
  * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 68 matching lines @@
     m_animationTimer.startOneShot(fireTime, FROM_HERE);
 }
 
 void SVGImageChromeClient::animationTimerFired(Timer<SVGImageChromeClient>*)
 {
     if (!m_image)
         return;
     // serviceScriptedAnimations runs requestAnimationFrame callbacks, but SVG
     // images can't have any so we assert there's no script.
     ScriptForbiddenScope forbidScript;
     m_image->frameView()->page()->animator().serviceScriptedAnimations(monotonicallyIncreasingTime());

[haraken, 2015/02/02 10:49:01]

m_image is on stack and thus it's protected, isn't it?

[sof, 2015/02/02 10:51:40]

Not necessarily. "this" would be, but it is not a GCed object.

[haraken, 2015/02/02 10:55:42]

ah, understood... This looks nasty and we might want to move ChromeClient to the
heap, ideally.

[fs, 2015/02/02 11:53:47]

Isn't 'this' owned by 'm_image' here though?

+
+    // If a GC strikes during the previous call and the SVG image isn't
+    // otherwise referred to, it will be finalized and m_image is cleared.
+    if (!m_image)
+        return;
+
     m_image->frameView()->updateLayoutAndStyleForPainting();
 }
 
 }