Predator and CL could not provide any possible suspects.
Using Code Search for the file, "InspectorAnimationAgent.cpp" assigning to concern owner.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/7ef6f8b862ad3fcc5f3e9634f77031d14d73862c

@suzyh -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Suzy's change is after the regression interval.

The relevant animation in the crash is likely one of

{
    var effect = new KeyframeEffect(node, { opacity : [ 0.9 ] }, 1000);
    var anim = node.animate({});
    anim.effect = effect;
}

{
    var anim = nodeRO.animate(null);
    anim.effect = null;
}


I suspect InspectorAnimationAgent::BuildObjectForAnimation is crashing in the first few lines, and needs to allow for 
effect() being null, and/or the element being null.

(For an example of element null, see the layout test keyframeeffect-no-target-crash.html.)

dgozman@ not sure if you're the right person for this but not sure who owns this part.

Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/63b39f94bd533b3f938fb00219a26b5f499f79d5

commit 63b39f94bd533b3f938fb00219a26b5f499f79d5
Author: Dmitry Gozman <dgozman@chromium.org>
Date: Mon Oct 02 21:54:10 2017

[DevTools] Make animation effect and target optional (as they may be null)

BUG= 761655 

Change-Id: Ib3bde429ea024b97a8713daa1d870f10de69daff
Reviewed-on: https://chromium-review.googlesource.com/692852
Reviewed-by: Andrey Kosyakov <caseq@chromium.org>
Commit-Queue: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#505804}
[add] https://crrev.com/63b39f94bd533b3f938fb00219a26b5f499f79d5/third_party/WebKit/LayoutTests/inspector-protocol/animation/animation-keyframe-null-expected.txt
[add] https://crrev.com/63b39f94bd533b3f938fb00219a26b5f499f79d5/third_party/WebKit/LayoutTests/inspector-protocol/animation/animation-keyframe-null.js
[modify] https://crrev.com/63b39f94bd533b3f938fb00219a26b5f499f79d5/third_party/WebKit/Source/core/inspector/InspectorAnimationAgent.cpp
[modify] https://crrev.com/63b39f94bd533b3f938fb00219a26b5f499f79d5/third_party/WebKit/Source/core/inspector/browser_protocol.json
[modify] https://crrev.com/63b39f94bd533b3f938fb00219a26b5f499f79d5/third_party/WebKit/Source/devtools/front_end/animation/AnimationModel.js

ClusterFuzz has detected this issue as fixed in range 505750:505833.

Detailed report: https://clusterfuzz.com/testcase?key=5920475523055616

Fuzzer: ochang_domfuzzer
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x000000a8
Crash State:
  blink::InspectorAnimationAgent::BuildObjectForAnimation
  blink::InspectorAnimationAgent::AnimationPlayStateChanged
  blink::probe::animationPlayStateChanged
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=471041:471079
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=505750:505833

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5920475523055616

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5920475523055616 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.