Fix Preloader Meta Accept-CH bug

Source/core/html/parser/HTMLPreloadScanner.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  * Copyright (C) 2009 Torch Mobile, Inc. http://www.torchmobile.com/
  * Copyright (C) 2010 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 519 matching lines @@
             return;
         }
         if (match(tagImpl, htmlTag) && token.getAttributeItem(manifestAttr)) {
             m_isAppCacheEnabled = true;
             return;
         }
         if (match(tagImpl, metaTag)) {
             const typename Token::Attribute* equivAttribute = token.getAttributeItem(http_equivAttr);
             if (equivAttribute) {
                 String equivAttributeValue(equivAttribute->value);
-                if (equalIgnoringCase(equivAttributeValue, "content-security-policy"))
+                if (equalIgnoringCase(equivAttributeValue, "content-security-policy")) {
                     m_isCSPEnabled = true;
-                else if (equalIgnoringCase(equivAttributeValue, "accept-ch"))
-                    handleAcceptClientHintsHeader(equivAttributeValue, m_clientHintsPreferences, nullptr);
+                } else if (equalIgnoringCase(equivAttributeValue, "accept-ch")) {
+                    const typename Token::Attribute* contentAttribute = token.getAttributeItem(contentAttr);
+                    if (contentAttribute)
+                        handleAcceptClientHintsHeader(String(contentAttribute->value), m_clientHintsPreferences, nullptr);

[Mike West, 2015/06/19 12:16:07]

Heh. Your reviewer should totally have caught that.

+                }
                 return;
             }
             const typename Token::Attribute* nameAttribute = token.getAttributeItem(nameAttr);
             if (nameAttribute && equalIgnoringCase(String(nameAttribute->value), "viewport")) {
                 const typename Token::Attribute* contentAttribute = token.getAttributeItem(contentAttr);
                 if (contentAttribute)
                     handleMetaViewport(String(contentAttribute->value), m_documentParameters.get());
                 return;
             }
         }
@@ skipping 74 matching lines @@
         mediaValues = givenMediaValues;
     else
         mediaValues = MediaValuesCached::create(*document);
     ASSERT(mediaValues->isSafeToSendToAnotherThread());
     defaultViewportMinWidth = document->viewportDefaultMinWidth();
     viewportMetaZeroValuesQuirk = document->settings() && document->settings()->viewportMetaZeroValuesQuirk();
     viewportMetaEnabled = document->settings() && document->settings()->viewportMetaEnabled();
 }
 
 }