Fix a crash when loading a multipart html page.

chrome/renderer/extensions/user_script_slave.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/user_script_slave.h"
 
 #include <map>
 
 #include "base/command_line.h"
 #include "base/logging.h"
@@ skipping 221 matching lines @@
 void UserScriptSlave::InjectScripts(WebFrame* frame,
                                     UserScript::RunLocation location) {
   // Normally we would use frame->document().url() to determine the document's
   // URL, but to decide whether to inject a content script, we use the URL from
   // the data source. This "quirk" helps prevents content scripts from
   // inadvertently adding DOM elements to the compose iframe in Gmail because
   // the compose iframe's dataSource URL is about:blank, but the document URL
   // changes to match the parent document after Gmail document.writes into
   // it to create the editor.
   // http://code.google.com/p/chromium/issues/detail?id=86742
-  GURL data_source_url = GURL(frame->dataSource()->request().url());
+  WebKit::WebDataSource* data_source = frame->dataSource() ?
+      frame->dataSource() : frame->provisionalDataSource();
+  CHECK(data_source);
+  GURL data_source_url = GURL(data_source->request().url());
   if (data_source_url.is_empty())
     return;
 
   if (frame->isViewSourceModeEnabled())
     data_source_url = GURL(chrome::kViewSourceScheme + std::string(":") +
                            data_source_url.spec());
 
   PerfTimer timer;
   int num_css = 0;
   int num_scripts = 0;
@@ skipping 74 matching lines @@
     if (num_scripts)
       UMA_HISTOGRAM_TIMES("Extensions.InjectEnd_Time", timer.Elapsed());
   } else if (location == UserScript::DOCUMENT_IDLE) {
     UMA_HISTOGRAM_COUNTS_100("Extensions.InjectIdle_ScriptCount", num_scripts);
     if (num_scripts)
       UMA_HISTOGRAM_TIMES("Extensions.InjectIdle_Time", timer.Elapsed());
   } else {
     NOTREACHED();
   }
 }