Fix null crash when creating KeyframeEffects with null targets

third_party/WebKit/Source/core/animation/KeyframeEffect.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 52 matching lines @@
         return nullptr;
     return create(element, EffectInput::convert(element, effectInput, executionContext, exceptionState), timing);
 }
 
 KeyframeEffect* KeyframeEffect::create(ExecutionContext* executionContext, Element* element, const EffectModelOrDictionarySequenceOrDictionary& effectInput, const KeyframeEffectOptions& timingInput, ExceptionState& exceptionState)
 {
     ASSERT(RuntimeEnabledFeatures::webAnimationsAPIEnabled());
     if (element)
         UseCounter::count(element->document(), UseCounter::AnimationConstructorKeyframeListEffectObjectTiming);
     Timing timing;
-    if (!TimingInput::convert(timingInput, timing, &element->document(), exceptionState))
+    Document* document = element ? &element->document() : nullptr;
+    if (!TimingInput::convert(timingInput, timing, document, exceptionState))
         return nullptr;
     return create(element, EffectInput::convert(element, effectInput, executionContext, exceptionState), timing);
 }
 
 KeyframeEffect* KeyframeEffect::create(ExecutionContext* executionContext, Element* element, const EffectModelOrDictionarySequenceOrDictionary& effectInput, ExceptionState& exceptionState)
 {
     ASSERT(RuntimeEnabledFeatures::webAnimationsAPIEnabled());
     if (element)
         UseCounter::count(element->document(), UseCounter::AnimationConstructorKeyframeListEffectNoTiming);
     return create(element, EffectInput::convert(element, effectInput, executionContext, exceptionState), Timing());
@@ skipping 287 matching lines @@
 
 DEFINE_TRACE(KeyframeEffect)
 {
     visitor->trace(m_target);
     visitor->trace(m_model);
     visitor->trace(m_sampledEffect);
     AnimationEffect::trace(visitor);
 }
 
 } // namespace blink