Keep SVGImage alive across its animation timer callback.

Source/core/svg/graphics/SVGImageChromeClient.cpp

 /*
  * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 68 matching lines @@
     m_animationTimer.startOneShot(fireTime, FROM_HERE);
 }
 
 void SVGImageChromeClient::animationTimerFired(Timer<SVGImageChromeClient>*)
 {
     if (!m_image)
         return;
     // serviceScriptedAnimations runs requestAnimationFrame callbacks, but SVG
     // images can't have any so we assert there's no script.
     ScriptForbiddenScope forbidScript;
+
+    // As neither SVGImage nor this chrome client object are on the Oilpan heap,
+    // this object's reference to the SVGImage will not be traced should a GC
+    // strike below. Hence, we must ensure that they both remain alive for
+    // duration of this call.
+    //
+    // This is cannot arise non-Oilpan as an ImageResource is an owned object
+    // and will be promptly released along with its (SVG)Image..and everything
+    // below, including this object and its timer. For code simplicity, the
+    // object protection isn't made the conditional on Oilpan.
+    //
+    // FIXME: Oilpan: move this and other ChromeClients to the Oilpan heap
+    // to render this protection redundant.
+    RefPtr<SVGImage> protect(m_image);
     m_image->frameView()->page()->animator().serviceScriptedAnimations(monotonicallyIncreasingTime());
     m_image->frameView()->updateLayoutAndStyleForPainting();
 }
 
-}
+} // namespace blink