Speculative fix for SelectorFilter crash.

third_party/WebKit/Source/core/css/SelectorFilter.cpp

Index: third_party/WebKit/Source/core/css/SelectorFilter.cpp
diff --git a/third_party/WebKit/Source/core/css/SelectorFilter.cpp b/third_party/WebKit/Source/core/css/SelectorFilter.cpp
index deb464e4eaf47d7cd877bd56831d9a5ec1e88490..07381af7178cc4f10056f0a88c062616467dca46 100644
--- a/third_party/WebKit/Source/core/css/SelectorFilter.cpp
+++ b/third_party/WebKit/Source/core/css/SelectorFilter.cpp
@@ -45,8 +45,12 @@ static inline void collectElementIdentifierHashes(const Element& element, Vector
     if (element.isStyledElement() && element.hasClass()) {
         const SpaceSplitString& classNames = element.classNames();
         size_t count = classNames.size();
-        for (size_t i = 0; i < count; ++i)
-            identifierHashes.append(classNames[i].impl()->existingHash() * ClassAttributeSalt);
+        for (size_t i = 0; i < count; ++i) {
+            DCHECK(classNames[i].impl());
+            // Speculative fix for https://crbug.com/646026
+            if (classNames[i].impl())
+                identifierHashes.append(classNames[i].impl()->existingHash() * ClassAttributeSalt);
+        }
     }
 }