Predator and CL did not provide any possible suspect.
Assigning to concern owner who might be related.

@shend -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Assigning to style TL because it's unrelated to my changes, but the crash happens in style code.

Also, alancutter, does this seem related to any of your changes?

I think this is also an instance of a stack overflow caused by bug 734737... adding inferno@ to confirm.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/991bda8a929e0ca9c871cd4ac2575f1b402d3783

commit 991bda8a929e0ca9c871cd4ac2575f1b402d3783
Author: Eddy Mead <meade@chromium.org>
Date: Mon Aug 21 09:33:00 2017

Handle neutral keyframes in CSSDefaultInterpolationType correctly.

Previously, a neutral keyframe would cause a segfault as we attempt
to create an InterpolationValue containing a nullptr CSSValue.

Bug:  738636 
Change-Id: I311aa417bd0272ee392c3161b2bff4e661882541
Reviewed-on: https://chromium-review.googlesource.com/586352
Commit-Queue: meade_UTC10 <meade@chromium.org>
Reviewed-by: Alan Cutter <alancutter@chromium.org>
Cr-Commit-Position: refs/heads/master@{#495892}
[add] https://crrev.com/991bda8a929e0ca9c871cd4ac2575f1b402d3783/third_party/WebKit/LayoutTests/animations/neutral-keyframe-crashtest.html
[modify] https://crrev.com/991bda8a929e0ca9c871cd4ac2575f1b402d3783/third_party/WebKit/Source/core/animation/CSSDefaultInterpolationType.cpp

ClusterFuzz has detected this issue as fixed in range 495879:495892.

Detailed report: https://clusterfuzz.com/testcase?key=6736641787166720

Fuzzer: dstockwell-anim-gen
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::StyleBuilder::ApplyProperty
  blink::CSSDefaultInterpolationType::Apply
  blink::InvalidatableInterpolation::ApplyStack
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=483543:483592
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=495879:495892

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6736641787166720

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6736641787166720 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.