Service worker creation from <link> leads to nullptr dereference

third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerLinkResource.cpp

Index: third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerLinkResource.cpp
diff --git a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerLinkResource.cpp b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerLinkResource.cpp
index a89dad8586c8a6ba0cd40655ab36b29a6d5eb93e..615201314d39b2b690de6d55b4026ae10e681e43 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerLinkResource.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerLinkResource.cpp
@@ -4,10 +4,12 @@
 
 #include "modules/serviceworkers/ServiceWorkerLinkResource.h"
 
+#include "bindings/core/v8/ExceptionState.h"
 #include "core/dom/Document.h"
 #include "core/frame/DOMWindow.h"
 #include "core/frame/LocalFrame.h"
 #include "core/html/HTMLLinkElement.h"
+#include "core/inspector/ConsoleMessage.h"
 #include "core/loader/FrameLoaderClient.h"
 #include "modules/serviceworkers/NavigatorServiceWorker.h"
 #include "modules/serviceworkers/ServiceWorkerContainer.h"
@@ -73,7 +75,17 @@ void ServiceWorkerLinkResource::process()
 
     TrackExceptionState exceptionState;
 
-    NavigatorServiceWorker::serviceWorker(&document, *document.frame()->domWindow()->navigator(), exceptionState)->registerServiceWorkerImpl(&document, scriptURL, scopeURL, wrapUnique(new RegistrationCallback(m_owner)));
+    ServiceWorkerContainer* container = NavigatorServiceWorker::serviceWorker(&document, *document.frame()->domWindow()->navigator(), exceptionState);
+
+    if (!container) {
+        DCHECK(exceptionState.hadException());
+        String message = exceptionState.message();
+        document.addConsoleMessage(ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, "Cannot register service worker with <link> element. " + message));
+        wrapUnique(new RegistrationCallback(m_owner))->onError(WebServiceWorkerError(WebServiceWorkerError::ErrorTypeSecurity, message));
+        return;
+    }
+
+    container->registerServiceWorkerImpl(&document, scriptURL, scopeURL, wrapUnique(new RegistrationCallback(m_owner)));
 }
 
 bool ServiceWorkerLinkResource::hasLoaded() const