From 519cf27a368e0af2176507101e6f51c63bb7493c Mon Sep 17 00:00:00 2001
From: Fredrik Söderquist <[email protected]>
Date: Tue, 13 Oct 2026 06:57:42 -0700
Subject: [PATCH] Harden ElementSMILAnimations::Apply() against removals during iteration

Style resolution during ApplyAnimationValues() can cause animation
elements to be removed.

Fixed: 572862424
Change-Id: I3233b96629fe48d13fcbd0c24bc75649b04b9ad7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8563759
Auto-Submit: Fredrik Söderquist <[email protected]>
Reviewed-by: Stephen Chenney <[email protected]>
Commit-Queue: Stephen Chenney <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1717535}
---
diff --git a/third_party/blink/renderer/core/svg/animation/element_smil_animations.cc b/third_party/blink/renderer/core/svg/animation/element_smil_animations.cc
index 4a4e55a..9d5996d 100644
--- a/third_party/blink/renderer/core/svg/animation/element_smil_animations.cc
+++ b/third_party/blink/renderer/core/svg/animation/element_smil_animations.cc
@@ -33,7 +33,8 @@
 
 bool ElementSMILAnimations::Apply(SMILTime elapsed) {
   bool did_apply = false;
-  for (SMILAnimationSandwich* sandwich : sandwiches_.Values()) {
+  HeapVector<Member<SMILAnimationSandwich>> sandwiches(sandwiches_.Values());
+  for (SMILAnimationSandwich* sandwich : sandwiches) {
     sandwich->UpdateActiveAnimationStack(elapsed);
     if (sandwich->ApplyAnimationValues())
       did_apply = true;