Through code search on file CSSInterpolationType.cpp, suspected CL is one of the below CL's.
https://chromium.googlesource.com/chromium/src/+/f2ec8922cbe5f632a937cf242faf5f23c0d1b3ff
https://chromium.googlesource.com/chromium/src/+/271557f792311061db727bd05dcedd282c1c2272%5E%21/third_party/WebKit/Source/core/animation/CSSInterpolationType.cpp
alancutter@, could you please take a look?
Thank you.

Minified test case:

<script src="../../resources/testharness.js"></script>
<div id="target"><script>
setup(() => {
  CSS.registerProperty({name: '--x'});
});
var animation = target.animate({'--x': 'inherit'}, {fill: 'forwards'});
assert_equals(target.getPropertyValue('--x'), '');
</script>

Will investigate.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1f1de2e98a13bae871ef18de230ec8ff45965eaf

commit 1f1de2e98a13bae871ef18de230ec8ff45965eaf
Author: alancutter <alancutter@chromium.org>
Date: Mon Jan 30 22:47:30 2017

Add null check to animations for registered custom property initial values

After a recent change to CSSInterpolationType for registered custom properties
it was assumed that all registered custom properties had initial CSSValues.
This is not the case and null derefs were reachable. This patch fixes up
the false assumption.

BUG= 684234 , 685472 

Review-Url: https://codereview.chromium.org/2649863006
Cr-Original-Commit-Position: refs/heads/master@{#445969}
Committed: https://chromium.googlesource.com/chromium/src/+/f2ec8922cbe5f632a937cf242faf5f23c0d1b3ff
Review-Url: https://codereview.chromium.org/2649863006
Cr-Commit-Position: refs/heads/master@{#447095}

[add] https://crrev.com/1f1de2e98a13bae871ef18de230ec8ff45965eaf/third_party/WebKit/LayoutTests/animations/custom-properties/empty-initial-value-crash.html
[modify] https://crrev.com/1f1de2e98a13bae871ef18de230ec8ff45965eaf/third_party/WebKit/Source/core/animation/CSSInterpolationType.cpp

ClusterFuzz has detected this issue as fixed in range 446721:447197.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4968508166504448

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  blink::CSSInterpolationType::applyCustomPropertyValue
  blink::InvalidatableInterpolation::applyStack
  void blink::StyleResolver::applyAnimatedProperties<
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=445982:445996
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=446721:447197

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94mjOYOsr2RLYYurYrev1RTtqDbzgOMY1QR8LoHkYG3_qdwpZJMv1biLxQgG8TCVoV-bwYzn5R9GMZsVcVNXw0-yveJ0kEPwedNDpULJyV2V1aizh6hWXJWVrF3abY2vpUG4ORquZtyiIBYLXLKkYyRlj3UEWEJRSWkTG3uRP02M4zQf9putRytJlLyNde3zkYiWjLm8wiAvgo9U18vOA__jlJiaqS-vyqAmkAgwdGsRYRoAnKf4n349ZociR7wPtmdYFiRDBET4codTQXuPAtGk5-0JJe7KVfROxUs6ru8cb8hB03MIEAWmR2EtM1Pkf7VoGhIUPW7_EqTkgK2MqivjMVaqZuVhURbtnxlnEGKUjjwmWk?testcase_id=4968508166504448


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.