Auto merge of #26503 - mrobinson:fix-rooting, r=jdm

Fix an issue with the rooting of animating nodes

Make sure nodes removed from map of rooted animating nodes are rooted on
the stack before triggering event handlers. We also make sure not to
call `from_untrusted_node_address` on nodes that aren't guaranteed to be
rooted.

Fixes #26498.

---
<!-- Thank you for contributing to Servo! Please replace each `[ ]` by `[X]` when the step is complete, and replace `___` with appropriate data: -->
- [x] `./mach build -d` does not report any errors
- [x] `./mach test-tidy` does not report any errors
- [x] These changes fix #26498.
- [x] There are tests for these changes

<!-- Also, please make sure that "Allow edits from maintainers" checkbox is checked, so that we can help you if you get stuck somewhere along the way.-->

<!-- Pull requests that do not address these steps are welcome, but they will require additional verification as part of the review process. -->

components/script/script_thread.rs

@@ -2976,13 +2976,10 @@ impl ScriptThread {
     ///
     /// TODO(mrobinson): Add support for more events.
     fn handle_transition_or_animation_event(&self, event: &TransitionOrAnimationEvent) {
-        let js_runtime = self.js_runtime.rt();
-        let node = unsafe { from_untrusted_node_address(js_runtime, event.node) };
-
-        // We limit the scope of the borrow here, so that we don't maintain this borrow
-        // and then incidentally trigger another layout. That might result in a double
-        // mutable borrow of `animating_nodes`.
-        {
+        // We limit the scope of the borrow here so that we aren't holding it when
+        // sending events. Event handlers may trigger another layout, resulting in
+        // a double mutable borrow of `animating_nodes`.
+        let node = {
             let mut animating_nodes = self.animating_nodes.borrow_mut();
             let nodes = match animating_nodes.get_mut(&event.pipeline_id) {
                 Some(nodes) => nodes,
@@ -2995,7 +2992,7 @@ impl ScriptThread {
 
             let node_index = nodes
                 .iter()
-                .position(|n| &**n as *const _ == &*node as *const _);
+                .position(|n| n.to_untrusted_node_address() == event.node);
             let node_index = match node_index {
                 Some(node_index) => node_index,
                 None => {
@@ -3006,10 +3003,14 @@ impl ScriptThread {
                 },
             };
 
+            // We need to root the node now, because if we remove it from the map
+            // a garbage collection might clean it up while we are sending events.
+            let node = DomRoot::from_ref(&*nodes[node_index]);
             if event.event_type.finalizes_transition_or_animation() {
                 nodes.remove(node_index);
             }
-        }
+            node
+        };
 
         let event_atom = match event.event_type {
             TransitionOrAnimationEventType::AnimationEnd => atom!("animationend"),