Keep SVGImage alive across its animation timer callback.

Source/core/svg/graphics/SVGImageChromeClient.cpp

Index: Source/core/svg/graphics/SVGImageChromeClient.cpp
diff --git a/Source/core/svg/graphics/SVGImageChromeClient.cpp b/Source/core/svg/graphics/SVGImageChromeClient.cpp
index 331860cd6e53373c47b0b837ab9add0d040826f2..ab8057a6cbf6da49516efbc0c72d8e0334d5164d 100644
--- a/Source/core/svg/graphics/SVGImageChromeClient.cpp
+++ b/Source/core/svg/graphics/SVGImageChromeClient.cpp
@@ -87,6 +87,12 @@ void SVGImageChromeClient::animationTimerFired(Timer<SVGImageChromeClient>*)
     // images can't have any so we assert there's no script.
     ScriptForbiddenScope forbidScript;
     m_image->frameView()->page()->animator().serviceScriptedAnimations(monotonicallyIncreasingTime());

[haraken, 2015/02/02 10:49:01]

m_image is on stack and thus it's protected, isn't it?

[sof, 2015/02/02 10:51:40]

Not necessarily. "this" would be, but it is not a GCed object.

[haraken, 2015/02/02 10:55:42]

ah, understood... This looks nasty and we might want to move ChromeClient to the
heap, ideally.

[fs, 2015/02/02 11:53:47]

Isn't 'this' owned by 'm_image' here though?

+
+    // If a GC strikes during the previous call and the SVG image isn't
+    // otherwise referred to, it will be finalized and m_image is cleared.
+    if (!m_image)
+        return;
+
     m_image->frameView()->updateLayoutAndStyleForPainting();
 }