Make sure there's a table header before attempting to account for its offset

third_party/WebKit/Source/core/layout/LayoutTableSection.cpp

 /*
  * Copyright (C) 1997 Martin Jones (mjones@kde.org)
  *           (C) 1997 Torben Weis (weis@kde.org)
  *           (C) 1998 Waldo Bastian (bastian@kde.org)
  *           (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009, 2010, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 985 matching lines @@
         if (rowLayoutObject) {
             rowLayoutObject->setLocation(LayoutPoint(0, m_rowPos[r]));
             rowLayoutObject->setLogicalWidth(logicalWidth());
             rowLayoutObject->setLogicalHeight(LayoutUnit(m_rowPos[r + 1] - m_rowPos[r] - vspacing));
             rowLayoutObject->updateLayerTransformAfterLayout();
             if (isPaginated) {
                 paginationStrutOnRow = paginationStrutForRow(rowLayoutObject, LayoutUnit(m_rowPos[r]));
                 if (paginationStrutOnRow) {
                     // If there isn't room for at least one content row on a page with a header group, then
                     // we won't repeat the header on each page.
-                    if (r == 0 && table()->sectionAbove(this) == table()->header())
+                    if (!r && table()->header() && table()->sectionAbove(this) == table()->header())
                         state.setHeightOffsetForTableHeaders(state.heightOffsetForTableHeaders() - table()->header()->logicalHeight());
                     // If we have a header group we will paint it at the top of each page, move the rows
                     // down to accomodate it.
                     paginationStrutOnRow += state.heightOffsetForTableHeaders().toInt();
                     for (unsigned rowIndex = r; rowIndex <= totalRows; rowIndex++)
                         m_rowPos[rowIndex] += paginationStrutOnRow;
                 }
             }
         }
 
@@ skipping 728 matching lines @@
     // Repeating table headers are painted once per fragmentation page/column. This does not go through the regular fragmentation machinery,
     // so we need special code to expand the invalidation rect to contain all positions of the header in all columns.
     // Note that this is in flow thread coordinates, not visual coordinates. The enclosing LayoutFlowThread will convert to visual coordinates.
     if (table()->header() == this && hasRepeatingHeaderGroup())
         rect.setHeight(table()->logicalHeight());
     return LayoutTableBoxComponent::mapToVisualRectInAncestorSpace(ancestor, rect, flags);
 }
 
 
 } // namespace blink