Service worker creation from <link> leads to nullptr dereference

third_party/WebKit/Source/modules/serviceworkers/NavigatorServiceWorker.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/serviceworkers/NavigatorServiceWorker.h"
 
 #include "core/dom/Document.h"
 #include "core/frame/LocalDOMWindow.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Navigator.h"
@@ skipping 42 matching lines @@
 {
     DCHECK(!navigator.frame() || executionContext->getSecurityOrigin()->canAccessCheckSuborigins(navigator.frame()->securityContext()->getSecurityOrigin()));
     return NavigatorServiceWorker::from(navigator).serviceWorker(navigator.frame(), exceptionState);
 }
 
 ServiceWorkerContainer* NavigatorServiceWorker::serviceWorker(LocalFrame* frame, ExceptionState& exceptionState)
 {
     if (frame && !frame->securityContext()->getSecurityOrigin()->canAccessServiceWorkers()) {
         if (frame->securityContext()->isSandboxed(SandboxOrigin))
             exceptionState.throwSecurityError("Service worker is disabled because the context is sandboxed and lacks the 'allow-same-origin' flag.");
+        else if (frame->securityContext()->getSecurityOrigin()->hasSuborigin())
+            exceptionState.throwSecurityError("Service worker is disabled because the context is in a suborigin.");
         else
             exceptionState.throwSecurityError("Access to service workers is denied in this document origin.");
         return nullptr;
     }
     if (!m_serviceWorker && frame) {
         DCHECK(frame->domWindow());
         m_serviceWorker = ServiceWorkerContainer::create(frame->domWindow()->getExecutionContext());
     }
     return m_serviceWorker.get();
 }
 
 void NavigatorServiceWorker::contextDestroyed()
 {
     m_serviceWorker = nullptr;
 }
 
 DEFINE_TRACE(NavigatorServiceWorker)
 {
     visitor->trace(m_serviceWorker);
     Supplement<Navigator>::trace(visitor);
     ContextLifecycleObserver::trace(visitor);
 }
 
 } // namespace blink