[MERGE 2704] IntersectionObserver: check for constructed Frame.

third_party/WebKit/Source/core/dom/IntersectionObserver.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/dom/IntersectionObserver.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "core/css/parser/CSSParserTokenRange.h"
 #include "core/css/parser/CSSTokenizer.h"
 #include "core/dom/Element.h"
@@ skipping 159 matching lines @@
 }
 
 void IntersectionObserver::observe(Element* target)
 {
     if (!m_root || !target || m_root.get() == target)
         return;
 
     if (target->ensureIntersectionObserverData().getObservationFor(*this))
         return;
 
-    bool shouldReportRootBounds = target->document().frame()->securityContext()->getSecurityOrigin()->canAccess(rootNode()->document().frame()->securityContext()->getSecurityOrigin());
+    bool shouldReportRootBounds = false;
+    LocalFrame* targetFrame = target->document().frame();
+    LocalFrame* rootFrame = rootNode()->document().frame();
+    if (targetFrame && rootFrame)
+        shouldReportRootBounds = targetFrame->securityContext()->getSecurityOrigin()->canAccess(rootFrame->securityContext()->getSecurityOrigin());
     IntersectionObservation* observation = new IntersectionObservation(*this, *target, shouldReportRootBounds);
     target->ensureIntersectionObserverData().addObservation(*observation);
     m_observations.add(observation);
 }
 
 void IntersectionObserver::unobserve(Element* target)
 {
     if (!target || !target->intersectionObserverData())
         return;
     // TODO(szager): unobserve callback
@@ skipping 113 matching lines @@
 
 DEFINE_TRACE(IntersectionObserver)
 {
     visitor->template registerWeakMembers<IntersectionObserver, &IntersectionObserver::clearWeakMembers>(this);
     visitor->trace(m_callback);
     visitor->trace(m_observations);
     visitor->trace(m_entries);
 }
 
 } // namespace blink