Fix nullptr deref in InvalidateKeyframeEffect

third_party/WebKit/Source/core/animation/Animation.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 1149 matching lines @@
 
 void Animation::DisableCompositedAnimationForTesting() {
   is_composited_animation_disabled_for_testing_ = true;
   CancelAnimationOnCompositor();
 }
 
 void Animation::InvalidateKeyframeEffect(const TreeScope& tree_scope) {
   if (!content_ || !content_->IsKeyframeEffectReadOnly())
     return;
 
-  Element& target = *ToKeyframeEffectReadOnly(content_.Get())->Target();
+  Element* target = ToKeyframeEffectReadOnly(content_.Get())->Target();
 
-  if (CSSAnimations::IsAffectedByKeyframesFromScope(target, tree_scope))
-    target.SetNeedsStyleRecalc(kLocalStyleChange,
-                               StyleChangeReasonForTracing::Create(
-                                   StyleChangeReason::kStyleSheetChange));
+  if (target &&
+      CSSAnimations::IsAffectedByKeyframesFromScope(*target, tree_scope)) {

[alancutter (OOO until 2018), 2017/06/26 04:38:47]

Please add a TODO to remove the use of CSSAnimations in the Animation code. They
should not be interdependent. This architectural smell is the source of the bug
and further issues unaddressed IMO.

[suzyh_UTC10 (ex-contributor), 2017/06/27 05:12:15]

Done.

+    target->SetNeedsStyleRecalc(kLocalStyleChange,
+                                StyleChangeReasonForTracing::Create(
+                                    StyleChangeReason::kStyleSheetChange));
+  }
 }
 
 void Animation::ResolvePromiseMaybeAsync(AnimationPromise* promise) {
   if (ScriptForbiddenScope::IsScriptForbidden()) {
     TaskRunnerHelper::Get(TaskType::kDOMManipulation, GetExecutionContext())
         ->PostTask(BLINK_FROM_HERE,
                    WTF::Bind(&AnimationPromise::Resolve<Animation*>,
                              WrapPersistent(promise), WrapPersistent(this)));
   } else {
     promise->Resolve(this);
@@ skipping 48 matching lines @@
   DCHECK(!compositor_player_);
 }
 
 void Animation::CompositorAnimationPlayerHolder::Detach() {
   DCHECK(compositor_player_);
   compositor_player_->SetAnimationDelegate(nullptr);
   animation_ = nullptr;
   compositor_player_.reset();
 }
 }  // namespace blink