Fix crash of paint invalidation tracking after a new frame is created

third_party/WebKit/Source/core/frame/FrameView.cpp

Index: third_party/WebKit/Source/core/frame/FrameView.cpp
diff --git a/third_party/WebKit/Source/core/frame/FrameView.cpp b/third_party/WebKit/Source/core/frame/FrameView.cpp
index eef1f28948372aa17a85e163cc5d4efb4a9a509a..4779ca75695d59fcf15469b007ca57fc9d30914d 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameView.cpp
@@ -3134,6 +3134,8 @@ std::unique_ptr<JSONArray> FrameView::trackedObjectPaintInvalidationsAsJSON() co
         if (!frame->isLocalFrame())
             continue;
         if (LayoutViewItem layoutView = toLocalFrame(frame)->contentLayoutItem()) {
+            if (!layoutView.frameView()->m_trackedObjectPaintInvalidations)
+                continue;
             for (const auto& item : *layoutView.frameView()->m_trackedObjectPaintInvalidations) {
                 std::unique_ptr<JSONObject> itemJSON = JSONObject::create();
                 itemJSON->setString("object", item.name);