Check document.firstChild() exists to avoid nullptr deref

third_party/WebKit/Source/core/dom/VisitedLinkState.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (c) 2011, Code Aurora Forum. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
@@ skipping 61 matching lines @@
         }
         if (isShadowHost(&node)) {
             for (ShadowRoot* root = node.youngestShadowRoot(); root; root = root->olderShadowRoot())
                 invalidateStyleForAllLinksRecursively(*root, invalidateVisitedLinkHashes);
         }
     }
 }
 
 void VisitedLinkState::invalidateStyleForAllLinks(bool invalidateVisitedLinkHashes)
 {
-    if (!m_linksCheckedForVisitedState.isEmpty())
+    if (!m_linksCheckedForVisitedState.isEmpty() && document().firstChild())
         invalidateStyleForAllLinksRecursively(*document().firstChild(), invalidateVisitedLinkHashes);
 }
 
 static void invalidateStyleForLinkRecursively(Node& rootNode, LinkHash linkHash)
 {
     for (Node& node : NodeTraversal::startsAt(&rootNode)) {
         if (node.isLink() && linkHashForElement(toElement(node)) == linkHash) {
             toElement(node).pseudoStateChanged(CSSSelector::PseudoLink);
             toElement(node).pseudoStateChanged(CSSSelector::PseudoVisited);
             toElement(node).pseudoStateChanged(CSSSelector::PseudoAnyLink);
         }
         if (isShadowHost(&node))
             for (ShadowRoot* root = node.youngestShadowRoot(); root; root = root->olderShadowRoot())
                 invalidateStyleForLinkRecursively(*root, linkHash);
     }
 }
 
 void VisitedLinkState::invalidateStyleForLink(LinkHash linkHash)
 {
-    if (m_linksCheckedForVisitedState.contains(linkHash))
+    if (m_linksCheckedForVisitedState.contains(linkHash) && document().firstChild())
         invalidateStyleForLinkRecursively(*document().firstChild(), linkHash);
 }
 
 EInsideLink VisitedLinkState::determineLinkStateSlowCase(const Element& element)
 {
     DCHECK(element.isLink());
     DCHECK(document().isActive());
     DCHECK(document() == element.document());
 
     const AtomicString& attribute = linkAttribute(element);
@@ skipping 16 matching lines @@
 
     return InsideUnvisitedLink;
 }
 
 DEFINE_TRACE(VisitedLinkState)
 {
     visitor->trace(m_document);
 }
 
 } // namespace blink