Fix nullptr deref in maybeRenderFallbackContent()

third_party/WebKit/Source/web/WebLocalFrameImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 2090 matching lines @@
   DCHECK(frame_request.GetSubstituteData().IsValid());
   frame_request.SetReplacesCurrentItem(replace);
   if (is_client_redirect)
     frame_request.SetClientRedirect(ClientRedirectPolicy::kClientRedirect);
 
   GetFrame()->Loader().Load(
       frame_request, static_cast<FrameLoadType>(web_frame_load_type),
       history_item, static_cast<HistoryLoadType>(web_history_load_type));
 }
 
-bool WebLocalFrameImpl::MaybeRenderFallbackContent(
-    const WebURLError& error) const {
+WebLocalFrame::FallbackContentResult
+WebLocalFrameImpl::MaybeRenderFallbackContent(const WebURLError& error) const {
   DCHECK(GetFrame());
 
   if (!GetFrame()->Owner() || !GetFrame()->Owner()->CanRenderFallbackContent())
-    return false;
+    return NoFallbackContent;
 
-  DCHECK(GetFrame()->Loader().ProvisionalDocumentLoader());
+  // provisionalDocumentLoader() can be null if a navigation started and
+  // completed (e.g. about:blank) while waiting for the navigation that wants
+  // to show fallback content.
+  if (!GetFrame()->Loader().ProvisionalDocumentLoader())
+    return NoLoadInProgress;
+
   GetFrame()->Loader().ProvisionalDocumentLoader()->LoadFailed(error);
-  return true;
+  return FallbackRendered;
 }
 
 // Called when a navigation is blocked because a Content Security Policy (CSP)
 // is infringed.
 void WebLocalFrameImpl::ReportContentSecurityPolicyViolation(
     const blink::WebContentSecurityPolicyViolation& violation) {
   AddMessageToConsole(blink::WebConsoleMessage(
       WebConsoleMessage::kLevelError, violation.console_message,
       violation.source_location.url, violation.source_location.line_number,
       violation.source_location.column_number));
@@ skipping 431 matching lines @@
 TextCheckerClient& WebLocalFrameImpl::GetTextCheckerClient() const {
   return *text_checker_client_;
 }
 
 void WebLocalFrameImpl::SetTextCheckClient(
     WebTextCheckClient* text_check_client) {
   text_check_client_ = text_check_client;
 }
 
 }  // namespace blink