Fix nullptr deref in InvalidateKeyframeEffect

third_party/WebKit/Source/core/animation/Animation.cpp

Index: third_party/WebKit/Source/core/animation/Animation.cpp
diff --git a/third_party/WebKit/Source/core/animation/Animation.cpp b/third_party/WebKit/Source/core/animation/Animation.cpp
index bd3225a61e3d3554eb391a103b7f23fc5a7bb609..dc8a9c30edbea651c5c4956918a14fbae96daa5a 100644
--- a/third_party/WebKit/Source/core/animation/Animation.cpp
+++ b/third_party/WebKit/Source/core/animation/Animation.cpp
@@ -1214,12 +1214,18 @@ void Animation::InvalidateKeyframeEffect(const TreeScope& tree_scope) {
   if (!content_ || !content_->IsKeyframeEffectReadOnly())
     return;
 
-  Element& target = *ToKeyframeEffectReadOnly(content_.Get())->Target();
-
-  if (CSSAnimations::IsAffectedByKeyframesFromScope(target, tree_scope))
-    target.SetNeedsStyleRecalc(kLocalStyleChange,
-                               StyleChangeReasonForTracing::Create(
-                                   StyleChangeReason::kStyleSheetChange));
+  Element* target = ToKeyframeEffectReadOnly(content_.Get())->Target();
+
+  // TODO(alancutter): Remove dependency of this function on CSSAnimations.
+  // This function makes the incorrect assumption that the animation uses
+  // @keyframes for its effect model when it may instead be using JS provided
+  // keyframes.
+  if (target &&
+      CSSAnimations::IsAffectedByKeyframesFromScope(*target, tree_scope)) {
+    target->SetNeedsStyleRecalc(kLocalStyleChange,
+                                StyleChangeReasonForTracing::Create(
+                                    StyleChangeReason::kStyleSheetChange));
+  }
 }
 
 void Animation::ResolvePromiseMaybeAsync(AnimationPromise* promise) {