Fix nullptr deref in InvalidateKeyframeEffect

third_party/WebKit/Source/core/animation/Animation.cpp

Index: third_party/WebKit/Source/core/animation/Animation.cpp
diff --git a/third_party/WebKit/Source/core/animation/Animation.cpp b/third_party/WebKit/Source/core/animation/Animation.cpp
index 355364e365b0103bb0452ffbc7abb170dfe8cb96..61c9aaa8901f4e286e1cb6e2aa45a9b148a67d1b 100644
--- a/third_party/WebKit/Source/core/animation/Animation.cpp
+++ b/third_party/WebKit/Source/core/animation/Animation.cpp
@@ -1167,12 +1167,14 @@ void Animation::InvalidateKeyframeEffect(const TreeScope& tree_scope) {
   if (!content_ || !content_->IsKeyframeEffectReadOnly())
     return;
 
-  Element& target = *ToKeyframeEffectReadOnly(content_.Get())->Target();
+  Element* target = ToKeyframeEffectReadOnly(content_.Get())->Target();
 
-  if (CSSAnimations::IsAffectedByKeyframesFromScope(target, tree_scope))
-    target.SetNeedsStyleRecalc(kLocalStyleChange,
-                               StyleChangeReasonForTracing::Create(
-                                   StyleChangeReason::kStyleSheetChange));
+  if (target &&
+      CSSAnimations::IsAffectedByKeyframesFromScope(*target, tree_scope)) {

[alancutter (OOO until 2018), 2017/06/26 04:38:47]

Please add a TODO to remove the use of CSSAnimations in the Animation code. They
should not be interdependent. This architectural smell is the source of the bug
and further issues unaddressed IMO.

[suzyh_UTC10 (ex-contributor), 2017/06/27 05:12:15]

Done.

+    target->SetNeedsStyleRecalc(kLocalStyleChange,
+                                StyleChangeReasonForTracing::Create(
+                                    StyleChangeReason::kStyleSheetChange));
+  }
 }
 
 void Animation::ResolvePromiseMaybeAsync(AnimationPromise* promise) {