The Web Inspector animation agent tracked live animations in m_animationIdMap, a map from an inspector animation-id string to a raw WebAnimation*. Nothing kept those pointers in sync with object lifetime: when a WebAnimation was destroyed, its entry remained as a dangling raw pointer. Subsequent agent operations dereferenced it — findAnimationId compared each stored raw pointer to a live animation, and resolveAnimation did animation->protectedScriptExecutionContext()->globalObject() — yielding a use-after-free. resolveAnimation had a second defect: protectedScriptExecutionContext() can return null for an animation detached from its context, and the code dereferenced it unconditionally (a null/недействительный access).

The fix changes m_animationIdMap to hold WeakRef<WebAnimation> values (which automatically drop when the animation dies, so lookups never see a stale pointer — findAnimationId now compares existingAnimation.ptr()), and bindAnimation stores the animation by weak reference. resolveAnimation now takes RefPtr scriptExecutionContext = animation->scriptExecutionContext() and returns an error (‘Animation is detached from context’) when it is null instead of dereferencing it.

The restored invariant is that the inspector’s animation table observes animations weakly and validates liveness/context before use. This path is only reachable while a Web Inspector session is attached and driving the Animation domain.

A use-after-free (plus a null-context dereference) of a WebAnimation held by raw pointer in the inspector animation table, in the WebContent process. It is only reachable while a Web Inspector session is attached and exercising the Animation domain, which sharply limits real-world exploitability from a plain web page; the realistic outcome is a crash, with UAF-to-corruption possible under inspector-driven conditions. Rated medium.