Crash fix.

chrome/browser/instant/instant_controller.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/instant/instant_controller.h"
 
 #include "base/command_line.h"
 #include "base/message_loop.h"
 #include "base/metrics/histogram.h"
 #include "base/rand_util.h"
@@ skipping 214 matching lines @@
 
 bool InstantController::IsCurrent() {
   // TODO(mmenke):  See if we can do something more intelligent in the
   //                navigation pending case.
   return is_displayable_ && !loader_->IsNavigationPending() &&
       !loader_->needs_reload();
 }
 
 bool InstantController::PrepareForCommit() {
   // If we are not in the HIDDEN field trial, return the status of the preview.
-  if (!InstantFieldTrial::IsHiddenExperiment(tab_contents_->profile()))
+  if (!tab_contents_ ||
+      !InstantFieldTrial::IsHiddenExperiment(tab_contents_->profile())) {
     return IsCurrent();
+  }
 
   TemplateURLService* model = TemplateURLServiceFactory::GetForProfile(
       tab_contents_->profile());
   if (!model)
     return false;
 
   const TemplateURL* template_url = model->GetDefaultSearchProvider();
   if (is_out_of_date_ ||
       !IsValidInstantTemplateURL(template_url) ||
       !loader_.get() ||
@@ skipping 290 matching lines @@
   if (destroy_factory_.empty()) {
     MessageLoop::current()->PostTask(
         FROM_HERE, destroy_factory_.NewRunnableMethod(
             &InstantController::DestroyLoaders));
   }
 }
 
 void InstantController::DestroyLoaders() {
   loaders_to_destroy_.reset();
 }