Fix crash when referencing a registered non-inherited custom property

third_party/WebKit/Source/core/css/resolver/CSSVariableResolver.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/css/resolver/CSSVariableResolver.h"
 
 #include "core/CSSPropertyNames.h"
 #include "core/CSSValueKeywords.h"
 #include "core/StyleBuilderFunctions.h"
 #include "core/StylePropertyShorthand.h"
@@ skipping 35 matching lines @@
 
   DCHECK(m_registry || !RuntimeEnabledFeatures::cssVariables2Enabled());
   const PropertyRegistry::Registration* registration =
       m_registry ? m_registry->registration(name) : nullptr;
 
   CSSVariableData* variableData = nullptr;
   if (!registration || registration->inherits()) {
     if (m_inheritedVariables)
       variableData = m_inheritedVariables->getVariable(name);
   } else {
-    variableData = m_nonInheritedVariables->getVariable(name);
+    if (m_nonInheritedVariables)
+      variableData = m_nonInheritedVariables->getVariable(name);
   }
   if (!variableData)
     return registration ? registration->initialVariableData() : nullptr;
   if (!variableData->needsVariableResolution())
     return variableData;
 
   RefPtr<CSSVariableData> newVariableData =
       resolveCustomProperty(name, *variableData);
   if (!registration) {
     m_inheritedVariables->setVariable(name, newVariableData);
@@ skipping 263 matching lines @@
 CSSVariableResolver::CSSVariableResolver(const StyleResolverState& state)
     : m_inheritedVariables(state.style()->inheritedVariables()),
       m_nonInheritedVariables(state.style()->nonInheritedVariables()),
       m_registry(state.document().propertyRegistry()) {}
 
 DEFINE_TRACE(CSSVariableResolver) {
   visitor->trace(m_registry);
 }
 
 }  // namespace blink