ResourceLoadTiming should not be assumed to be available in ResourceTiming.

third_party/WebKit/Source/core/timing/PerformanceResourceTiming.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  * Copyright (C) 2012 Intel Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 118 matching lines @@
 
 DOMHighResTimeStamp PerformanceResourceTiming::redirectEnd() const {
   if (!m_lastRedirectEndTime || !m_allowRedirectDetails)
     return 0.0;
 
   return PerformanceBase::monotonicTimeToDOMHighResTimeStamp(
       m_timeOrigin, m_lastRedirectEndTime);
 }
 
 DOMHighResTimeStamp PerformanceResourceTiming::fetchStart() const {
+  if (!m_timing)
+    return PerformanceEntry::startTime();
+
   if (m_lastRedirectEndTime) {
-    // FIXME: ASSERT(m_timing) should be in constructor once timeticks of
-    // AppCache is exposed from chrome network stack, crbug/251100

[panicker, 2017/03/08 23:16:51]

This assumption was apparently fine in Jun 2013 (in this patch:
https://chromiumcodereview.appspot.com/16950017/) when the code was authored,
but has since become invalid. The crashes started in Nov 2015.
All other dereferences of m_timing check for null, except for this one.

-    ASSERT(m_timing);
     return PerformanceBase::monotonicTimeToDOMHighResTimeStamp(
         m_timeOrigin, m_timing->requestTime());
   }
 
   if (DOMHighResTimeStamp workerReadyTime = workerReady())
     return workerReadyTime;
 
   return PerformanceEntry::startTime();
 }
 
@@ skipping 127 matching lines @@
   builder.addNumber("secureConnectionStart", secureConnectionStart());
   builder.addNumber("requestStart", requestStart());
   builder.addNumber("responseStart", responseStart());
   builder.addNumber("responseEnd", responseEnd());
   builder.addNumber("transferSize", transferSize());
   builder.addNumber("encodedBodySize", encodedBodySize());
   builder.addNumber("decodedBodySize", decodedBodySize());
 }
 
 }  // namespace blink