Service worker creation from <link> leads to nullptr dereference

third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerLinkResource.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/serviceworkers/ServiceWorkerLinkResource.h"
 
+#include "bindings/core/v8/ExceptionState.h"
 #include "core/dom/Document.h"
 #include "core/frame/DOMWindow.h"
 #include "core/frame/LocalFrame.h"
 #include "core/html/HTMLLinkElement.h"
+#include "core/inspector/ConsoleMessage.h"
 #include "core/loader/FrameLoaderClient.h"
 #include "modules/serviceworkers/NavigatorServiceWorker.h"
 #include "modules/serviceworkers/ServiceWorkerContainer.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebScheduler.h"
 #include "wtf/PtrUtil.h"
 
 namespace blink {
 
 namespace {
@@ skipping 45 matching lines @@
     String scope = m_owner->scope();
     KURL scopeURL;
     if (scope.isNull())
         scopeURL = KURL(scriptURL, "./");
     else
         scopeURL = document.completeURL(scope);
     scopeURL.removeFragmentIdentifier();
 
     TrackExceptionState exceptionState;
 
-    NavigatorServiceWorker::serviceWorker(&document, *document.frame()->domWindow()->navigator(), exceptionState)->registerServiceWorkerImpl(&document, scriptURL, scopeURL, wrapUnique(new RegistrationCallback(m_owner)));
+    ServiceWorkerContainer* container = NavigatorServiceWorker::serviceWorker(&document, *document.frame()->domWindow()->navigator(), exceptionState);
+
+    if (!container) {
+        DCHECK(exceptionState.hadException());
+        String message = exceptionState.message();
+        document.addConsoleMessage(ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, "Cannot register service worker with <link> element. " + message));
+        wrapUnique(new RegistrationCallback(m_owner))->onError(WebServiceWorkerError(WebServiceWorkerError::ErrorTypeSecurity, message));
+        return;
+    }
+
+    container->registerServiceWorkerImpl(&document, scriptURL, scopeURL, wrapUnique(new RegistrationCallback(m_owner)));
 }
 
 bool ServiceWorkerLinkResource::hasLoaded() const
 {
     return false;
 }
 
 void ServiceWorkerLinkResource::ownerRemoved()
 {
     process();
 }
 
 ServiceWorkerLinkResource::ServiceWorkerLinkResource(HTMLLinkElement* owner)
     : LinkResource(owner)
 {
 }
 
 } // namespace blink