Bug 1401809 - Use Atom::from(nsIAtom) to increment reference count in case of dynamic atom for will-change. r?xidorn
If we don't increment the reference count for the Atom in servo side, it's
possible to try to release the Atom in servo side even if we have already
released in gecko side. When it happens, nsIAtom::mKind is no longer reliable.
MozReview-Commit-ID: GrxbcYxowRB
new file mode 100644
--- /dev/null
+++ b/dom/animation/test/crashtests/1401809.html
@@ -0,0 +1,14 @@
+<html>
+ <head>
+ <style></style>
+ <script>
+ o1 = document.createElement('t');
+ document.documentElement.appendChild(o1);
+ document.styleSheets[0].insertRule('* { will-change:an }', 0);
+ k = new KeyframeEffect(o1, [{'willChange':'s'}], {'':''});
+ k = null;
+ SpecialPowers.forceGC();
+ SpecialPowers.forceCC();
+ </script>
+ </head>
+</html>
--- a/dom/animation/test/crashtests/crashtests.list
+++ b/dom/animation/test/crashtests/crashtests.list
@@ -28,8 +28,9 @@ pref(dom.animations-api.core.enabled,tru
pref(dom.animations-api.core.enabled,true) load 1334583-1.html
pref(dom.animations-api.core.enabled,true) load 1335998-1.html
pref(dom.animations-api.core.enabled,true) load 1343589-1.html
pref(dom.animations-api.core.enabled,true) load 1359658-1.html
pref(dom.animations-api.core.enabled,true) load 1373712-1.html
pref(dom.animations-api.core.enabled,true) load 1379606-1.html
pref(dom.animations-api.core.enabled,true) load 1393605-1.html
load 1400022-1.html
+pref(dom.animations-api.core.enabled,true) load 1401809.html
