Use AtomicString instead of StringImpl* in PropertyHandle

third_party/WebKit/LayoutTests/animations/custom-property-animation-crash.html

Index: third_party/WebKit/LayoutTests/animations/custom-property-animation-crash.html
diff --git a/third_party/WebKit/LayoutTests/animations/custom-property-animation-crash.html b/third_party/WebKit/LayoutTests/animations/custom-property-animation-crash.html
new file mode 100644
index 0000000000000000000000000000000000000000..32ce8e458b8bd32c8ce30b765cb37afa4eda0e04
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/animations/custom-property-animation-crash.html
@@ -0,0 +1,25 @@
+<script src="../resources/testharness.js"></script>
+<script src="../resources/testharnessreport.js"></script>
+<div id="target"></div>
+<script>
+promise_test(() => {
+  return new Promise(resolve => {
+    target.animate([
+      {'resize':'none'},
+      {'resize':'none'},
+    ], {
+      duration: 1000,
+      delay: 100,
+    });
+    target.animate([
+      {'--custom-property-name':'custom-value'},
+      {'--custom-property-name':'custom-value'},
+    ], 1);
+    // This specific combination of async behaviour is required to trigger the crash,
+    // creating functions here prevents the crash. This is probably due to V8 GC
+    // implementation details.
+    setInterval(gc);
+    setTimeout(resolve);
+  });
+}, 'Do not crash in ASAN when using custom properties in element.animate()');
+</script>