Call ResetAnimation synchronously in ImageResource::AllClientsAndObserversRemoved

Running ResetAnimation asynchronously gives the "wake-up timer" used by
the SMIL animation engine an opportunity to race with the actual
sweeping of the surrounding objects (ImageResourceContent, SVGImage with
contained Page). Said sweeping could thus take place when the handler
for the "wake-up timer" was running, leading to UAFs. Running
ResetAnimation synchronously stops the "wake-up timer" and prevents the

This essentially reverts the workaround added by
r400934 ( After the change made by
r412798 (, the issue worked around - that the SMIL
animation engine could be re-entered via the ResetAnimation call during
GC - have been eliminated. (Now, after said CL, what
SVGImage::ResetAnimation does is to pause the animation, stopping all
timers, and set a flag that the animation state needs to be reset. The
resetting then happens later as needed.)

Bug: 924450
Change-Id: Ideef98f05c81d779950aac56506cbbe152762afa
Reviewed-by: Kentaro Hara <>
Commit-Queue: Fredrik Söderquist <>
Cr-Commit-Position: refs/heads/master@{#627431}
diff --git a/third_party/blink/renderer/core/loader/resource/ b/third_party/blink/renderer/core/loader/resource/
index 651e85b..889d2d65 100644
--- a/third_party/blink/renderer/core/loader/resource/
+++ b/third_party/blink/renderer/core/loader/resource/
@@ -313,16 +313,7 @@
   // TODO(hiroshige): Make the CHECK condition cleaner.
   CHECK(is_during_finish_as_error_ || !GetContent()->HasImage() ||
-  // If possible, delay the resetting until back at the event loop. Doing so
-  // after a conservative GC prevents resetAnimation() from upsetting ongoing
-  // animation updates (
-  if (!ThreadHeap::WillObjectBeLazilySwept(this)) {
-    Thread::Current()->GetTaskRunner()->PostTask(
-        FROM_HERE, WTF::Bind(&ImageResourceContent::DoResetAnimation,
-                             WrapWeakPersistent(GetContent())));
-  } else {
-    GetContent()->DoResetAnimation();
-  }
+  GetContent()->DoResetAnimation();
   if (multipart_parser_)