HTMLPreloadScanner should only use valid <base> urls

Source/core/html/parser/HTMLPreloadScanner.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  * Copyright (C) 2009 Torch Mobile, Inc. http://www.torchmobile.com/
  * Copyright (C) 2010 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 497 matching lines @@
     default: {
         return;
     }
     }
 }
 
 template<typename Token>
 void TokenPreloadScanner::updatePredictedBaseURL(const Token& token)
 {
     ASSERT(m_predictedBaseElementURL.isEmpty());
-    if (const typename Token::Attribute* hrefAttribute = token.getAttributeItem(hrefAttr))
-        m_predictedBaseElementURL = KURL(m_documentURL, stripLeadingAndTrailingHTMLSpaces(hrefAttribute->value)).copy();
+    if (const typename Token::Attribute* hrefAttribute = token.getAttributeItem(hrefAttr)) {
+        KURL url(m_documentURL, stripLeadingAndTrailingHTMLSpaces(hrefAttribute->value));
+        m_predictedBaseElementURL = url.isValid() ? url.copy() : KURL();
+    }
 }
 
 HTMLPreloadScanner::HTMLPreloadScanner(const HTMLParserOptions& options, const KURL& documentURL, PassRefPtr<MediaValues> mediaValues)
     : m_scanner(documentURL, mediaValues)
     , m_tokenizer(HTMLTokenizer::create(options))
 {
 }
 
 HTMLPreloadScanner::~HTMLPreloadScanner()
 {
@@ skipping 20 matching lines @@
         if (m_token.type() == HTMLToken::StartTag)
             m_tokenizer->updateStateFor(attemptStaticStringCreation(m_token.name(), Likely8Bit));
         m_scanner.scan(m_token, m_source, requests);
         m_token.clear();
     }
 
     preloader->takeAndPreload(requests);
 }
 
 }