Prevent crash in DocumentLoader::dataReceived

Source/core/loader/DocumentLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 591 matching lines @@
 
     commitIfReady();
     if (!frameLoader())
         return;
     if (isArchiveMIMEType(response().mimeType()))
         return;
     commitData(data, length);
 
     // If we are sending data to MediaDocument, we should stop here
     // and cancel the request.
-    if (m_frame->document()->isMediaDocument())
+    if (m_frame && m_frame->document()->isMediaDocument())
         cancelMainResourceLoad(ResourceError::cancelledError(m_request.url()));
 }
 
 void DocumentLoader::checkLoadComplete()
 {
     if (!m_frame || isLoading())
         return;
     // FIXME: This ASSERT is always triggered.
     // See https://bugs.webkit.org/show_bug.cgi?id=110937
     // ASSERT(this == frameLoader()->activeDocumentLoader())
@@ skipping 318 matching lines @@
 void DocumentLoader::replaceDocument(const String& source, Document* ownerDocument)
 {
     m_frame->loader()->stopAllLoaders();
     m_writer = createWriterFor(m_frame, ownerDocument, m_frame->document()->url(), mimeType(), m_writer ? m_writer->encoding() : "",  m_writer ? m_writer->encodingWasChosenByUser() : false, true);
     if (!source.isNull())
         m_writer->appendReplacingData(source);
     endWriting(m_writer.get());
 }
 
 } // namespace WebCore