Bug 1178662 part 7 - Remove relationship of timeline and animation when setting new timeline. r?birtles If we run following code, content process will crash. ------ anim1.timeline = timeline; anim2.timeline = document.timeline; anim2.timeline = timeline; ------ The AnimationTimeline has LinkedList variant. (called mAnimationOrder) And Animation is sub-class of LinkedListElement. We will create the relationship of AnimationTimeline and Animation when calling the AnimationTimeline::NotifyAnimationUpdated. However we didn't remove these relation ship when setting new timeline. So we should remove these relationship when setting new timeline object. MozReview-Commit-ID: RDyranduTA

--- a/dom/animation/Animation.cpp
+++ b/dom/animation/Animation.cpp
@@ -159,16 +159,20 @@ Animation::SetTimeline(AnimationTimeline
 void
 Animation::SetTimelineNoUpdate(AnimationTimeline* aTimeline)
 {
   RefPtr<AnimationTimeline> oldTimeline = mTimeline;
   if (mTimeline == aTimeline) {
     return;
   }
 
+  if (mTimeline) {
+    mTimeline->RemoveAnimation(this);
+  }
+
   mTimeline = aTimeline;
   if (!mStartTime.IsNull()) {
     mHoldTime.SetNull();
   }
 
   UpdateTiming(SeekFlag::NoSeek, SyncNotifyFlag::Async);
 }