Fix crash when "contenteditable" attribute changes

third_party/WebKit/Source/core/html/HTMLElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLElement.cpp b/third_party/WebKit/Source/core/html/HTMLElement.cpp
index e34b2e72ede84fba5f4c827b621f15ed5e2583ec..69d1fc0537bfa0aa545342e1c9574c66fb19a3f2 100644
--- a/third_party/WebKit/Source/core/html/HTMLElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLElement.cpp
@@ -437,8 +437,10 @@ void HTMLElement::attributeChanged(const AttributeModificationParams& params) {
     if (adjustedFocusedElementInTreeScope() == this)
       blur();
   } else if (params.name == contenteditableAttr) {
-    document().frame()->spellChecker().removeSpellingAndGrammarMarkers(
-        *this, SpellChecker::ElementsType::kOnlyNonEditable);
+    if (document().frame()) {
+      document().frame()->spellChecker().removeSpellingAndGrammarMarkers(
+          *this, SpellChecker::ElementsType::kOnlyNonEditable);
+    }
     if (adjustedFocusedElementInTreeScope() != this)
       return;
     // The attribute change may cause supportsFocus() to return false