Speculative fix for SelectorFilter crash.

third_party/WebKit/Source/core/css/SelectorFilter.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 2004-2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2006, 2007 Nicholas Shanks (webkit@nickshanks.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (c) 2011, Code Aurora Forum. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
@@ skipping 27 matching lines @@
 enum { TagNameSalt = 13, IdAttributeSalt = 17, ClassAttributeSalt = 19 };
 
 static inline void collectElementIdentifierHashes(const Element& element, Vector<unsigned, 4>& identifierHashes)
 {
     identifierHashes.append(element.localNameForSelectorMatching().impl()->existingHash() * TagNameSalt);
     if (element.hasID())
         identifierHashes.append(element.idForStyleResolution().impl()->existingHash() * IdAttributeSalt);
     if (element.isStyledElement() && element.hasClass()) {
         const SpaceSplitString& classNames = element.classNames();
         size_t count = classNames.size();
-        for (size_t i = 0; i < count; ++i)
-            identifierHashes.append(classNames[i].impl()->existingHash() * ClassAttributeSalt);
+        for (size_t i = 0; i < count; ++i) {
+            DCHECK(classNames[i].impl());
+            // Speculative fix for https://crbug.com/646026
+            if (classNames[i].impl())
+                identifierHashes.append(classNames[i].impl()->existingHash() * ClassAttributeSalt);
+        }
     }
 }
 
 void SelectorFilter::pushParentStackFrame(Element& parent)
 {
     ASSERT(m_ancestorIdentifierFilter);
     ASSERT(m_parentStack.isEmpty() || m_parentStack.last().element == parent.parentOrShadowHostElement());
     ASSERT(!m_parentStack.isEmpty() || !parent.parentOrShadowHostElement());
     m_parentStack.append(ParentStackFrame(parent));
     ParentStackFrame& parentFrame = m_parentStack.last();
@@ skipping 123 matching lines @@
 {
     visitor->trace(element);
 }
 
 DEFINE_TRACE(SelectorFilter)
 {
     visitor->trace(m_parentStack);
 }
 
 } // namespace blink