Service worker creation from <link> leads to nullptr dereference

third_party/WebKit/LayoutTests/http/tests/serviceworker/resources/iframe-register-link-element.html

Index: third_party/WebKit/LayoutTests/http/tests/serviceworker/resources/iframe-register-link-element.html
diff --git a/third_party/WebKit/LayoutTests/http/tests/serviceworker/resources/iframe-register-link-element.html b/third_party/WebKit/LayoutTests/http/tests/serviceworker/resources/iframe-register-link-element.html
new file mode 100644
index 0000000000000000000000000000000000000000..59c050fbac3c257c04d1308061d9e00bb993781a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/resources/iframe-register-link-element.html
@@ -0,0 +1,12 @@
+<script>
+var link = document.createElement('link');
+link.setAttribute('rel', 'serviceworker');
+link.setAttribute('href', 'fetch-event-network-error-worker.js');

[falken, 2016/09/23 01:22:33]

similarly, I'd use empty-worker.js here.

[jww, 2016/09/23 04:34:47]

Done.

+link.onload = function() {
+    top.postMessage('loaded', '*');
+}
+link.onerror = function(e) {
+    top.postMessage('error', '*');
+}
+document.getElementsByTagName('head')[0].appendChild(link);
+</script>