Fix nullptr deref in maybeRenderFallbackContent()

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 5250 matching lines @@
   if (!ShouldDisplayErrorPageForFailedLoad(error_code, common_params.url)) {
     // The browser expects this frame to be loading an error page. Inform it
     // that the load stopped.
     Send(new FrameHostMsg_DidStopLoading(routing_id_));
     browser_side_navigation_pending_ = false;
     return;
   }
 
   // On load failure, a frame can ask its owner to render fallback content.
   // When that happens, don't load an error page.
+  bool was_loading = !frame_->isLoading();

[arthursonzogni, 2017/04/05 07:53:34]

This is wrong here.
You meant: bool was_loading = frame_->isLoading();
Without the "!"

[Nate Chapin, 2017/04/11 18:39:00]

Done.

   if (frame_->maybeRenderFallbackContent(error)) {
+    // If the frame wasn't loading but was fallback-elligible, the fallback
+    // content won't be shown. However, showing an error page isn't right
+    // either, as the frame has already been populated with something unrelated
+    // to this navigation failure. In that case, just send a stop IPC to the
+    // browser to unwind its state, and leave the frame as-is.
+    if (!was_loading)
+      Send(new FrameHostMsg_DidStopLoading(routing_id_));
     browser_side_navigation_pending_ = false;
     return;
   }
 
   // Make sure errors are not shown in view source mode.
   frame_->enableViewSourceMode(false);
 
   // Replace the current history entry in reloads, and loads of the same url.
   // This corresponds to Blink's notion of a standard commit.
   // Also replace the current history entry if the browser asked for it
@@ skipping 1689 matching lines @@
       policy(info.defaultPolicy),
       replaces_current_history_item(info.replacesCurrentHistoryItem),
       history_navigation_in_new_child_frame(
           info.isHistoryNavigationInNewChildFrame),
       client_redirect(info.isClientRedirect),
       cache_disabled(info.isCacheDisabled),
       form(info.form),
       source_location(info.sourceLocation) {}
 
 }  // namespace content