Fix crash when "contenteditable" attribute changes

third_party/WebKit/Source/core/html/HTMLElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004-2008, 2013, 2014 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2011 Motorola Mobility. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 419 matching lines @@
 void HTMLElement::attributeChanged(const AttributeModificationParams& params) {
   Element::attributeChanged(params);
   if (params.reason != AttributeModificationReason::kDirectly)
     return;
   // adjustedFocusedElementInTreeScope() is not trivial. We should check
   // attribute names, then call adjustedFocusedElementInTreeScope().
   if (params.name == hiddenAttr && !params.newValue.isNull()) {
     if (adjustedFocusedElementInTreeScope() == this)
       blur();
   } else if (params.name == contenteditableAttr) {
-    document().frame()->spellChecker().removeSpellingAndGrammarMarkers(
-        *this, SpellChecker::ElementsType::kOnlyNonEditable);
+    if (document().frame()) {
+      document().frame()->spellChecker().removeSpellingAndGrammarMarkers(
+          *this, SpellChecker::ElementsType::kOnlyNonEditable);
+    }
     if (adjustedFocusedElementInTreeScope() != this)
       return;
     // The attribute change may cause supportsFocus() to return false
     // for the element which had focus.
     //
     // TODO(tkent): We should avoid updating style.  We'd like to check only
     // DOM-level focusability here.
     document().updateStyleAndLayoutTreeForNode(this);
     if (!supportsFocus())
       blur();
@@ skipping 766 matching lines @@
 
 #ifndef NDEBUG
 
 // For use in the debugger
 void dumpInnerHTML(blink::HTMLElement*);
 
 void dumpInnerHTML(blink::HTMLElement* element) {
   printf("%s\n", element->innerHTML().ascii().data());
 }
 #endif