Bug 1249564 - Part 2: Cycle collect AnimationEffectTimingReadOnly. r=birtles

Add KeyframeEffectReadOnly::mTiming into the list of cycle collection to
avoid any possible memory leak.

MozReview-Commit-ID: C5mFQ7TsqC7

--HG--
extra : rebase_source : 8ee1e58d69a3becb0b8566fa3529154bb66d3064

dom/animation/KeyframeEffect.cpp

@@ -62,7 +62,8 @@ namespace dom {
 NS_IMPL_CYCLE_COLLECTION_INHERITED(KeyframeEffectReadOnly,
                                    AnimationEffectReadOnly,
                                    mTarget,
-                                   mAnimation)
+                                   mAnimation,
+                                   mTiming)
 
 NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN_INHERITED(KeyframeEffectReadOnly,
                                                AnimationEffectReadOnly)
@@ -92,7 +93,7 @@ KeyframeEffectReadOnly::KeyframeEffectReadOnly(
   AnimationEffectTimingReadOnly* aTiming)
   : AnimationEffectReadOnly(aDocument)
   , mTarget(aTarget)
-  , mTiming(*aTiming)
+  , mTiming(aTiming)
   , mPseudoType(aPseudoType)
   , mInEffectOnLastAnimationTimingUpdate(false)
 {
@@ -1403,7 +1404,11 @@ void KeyframeEffect::NotifySpecifiedTimingUpdated()
 
 KeyframeEffect::~KeyframeEffect()
 {
-  mTiming->Unlink();
+  // mTiming is cycle collected, so we have to do null check first even though
+  // mTiming shouldn't be null during the lifetime of KeyframeEffect.
+  if (mTiming) {
+    mTiming->Unlink();
+  }
 }
 
 } // namespace dom

dom/animation/KeyframeEffect.h

@@ -372,7 +372,7 @@ protected:
   nsCOMPtr<Element> mTarget;
   RefPtr<Animation> mAnimation;
 
-  OwningNonNull<AnimationEffectTimingReadOnly> mTiming;
+  RefPtr<AnimationEffectTimingReadOnly> mTiming;
   CSSPseudoElementType mPseudoType;
 
   // The specified keyframes.