Fix nullptr deref in maybeRenderFallbackContent()

third_party/WebKit/Source/web/WebLocalFrameImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 2066 matching lines @@
       static_cast<HistoryLoadType>(webHistoryLoadType));
 }
 
 bool WebLocalFrameImpl::maybeRenderFallbackContent(
     const WebURLError& error) const {
   DCHECK(frame());
 
   if (!frame()->owner() || !frame()->owner()->canRenderFallbackContent())
     return false;
 
-  DCHECK(frame()->loader().provisionalDocumentLoader());
-  frame()->loader().provisionalDocumentLoader()->loadFailed(error);
+  // provisionalDocumentLoader() can be null if a navigation started and
+  // completed (e.g. about:blank) while waiting for the navigation that wants
+  // to show fallback content.
+  if (frame()->loader().provisionalDocumentLoader())
+    frame()->loader().provisionalDocumentLoader()->loadFailed(error);
   return true;
 }
 
 // Called when a navigation is blocked because a Content Security Policy (CSP)
 // is infringed.
 void WebLocalFrameImpl::reportContentSecurityPolicyViolation(
     const blink::WebContentSecurityPolicyViolation& violation) {
   addMessageToConsole(blink::WebConsoleMessage(
       WebConsoleMessage::LevelError, violation.consoleMessage,
       violation.sourceLocation.url, violation.sourceLocation.lineNumber,
@@ skipping 417 matching lines @@
         createMarkup(startPosition, endPosition, AnnotateForInterchange,
                      ConvertBlocksToInlines::NotConvert, ResolveNonLocalURLs);
   } else {
     clipHtml =
         createMarkup(endPosition, startPosition, AnnotateForInterchange,
                      ConvertBlocksToInlines::NotConvert, ResolveNonLocalURLs);
   }
 }
 
 }  // namespace blink