https://github.com/servo/servo/commits/5d3847dddc9bb7907abfa5d38a7927d6c656fbc1/components/layout/animation.rs sends an asynchronous message to the script thread that contains an UnsafeNode value. When the script thread processes the message, it casts the unsafe node to a DOM node and tries to use it. If the node has been GCed since the layout event that caused the message to be sent, this is a crash.

I propose fixing this in the same way that #14962 deals with asynchronous operations involving DOM nodes - collect them during layout and have the script thread retrieve them immediately to prevent risk of them being GCed.

I hit this in a debugger while running the TodoMVC benchmark: https://lhorie.github.io/todomvc-perf-comparison/todomvc-benchmark/