Fix nullptr deref in maybeRenderFallbackContent()

third_party/WebKit/Source/web/WebLocalFrameImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 2097 matching lines @@
       history_item, static_cast<HistoryLoadType>(web_history_load_type));
 }
 
 bool WebLocalFrameImpl::MaybeRenderFallbackContent(
     const WebURLError& error) const {
   DCHECK(GetFrame());
 
   if (!GetFrame()->Owner() || !GetFrame()->Owner()->CanRenderFallbackContent())
     return false;
 
-  DCHECK(GetFrame()->Loader().ProvisionalDocumentLoader());
-  GetFrame()->Loader().ProvisionalDocumentLoader()->LoadFailed(error);
+  // provisionalDocumentLoader() can be null if a navigation started and
+  // completed (e.g. about:blank) while waiting for the navigation that wants
+  // to show fallback content.
+  if (GetFrame()->Loader().ProvisionalDocumentLoader())
+    GetFrame()->Loader().ProvisionalDocumentLoader()->LoadFailed(error);
   return true;
 }
 
 // Called when a navigation is blocked because a Content Security Policy (CSP)
 // is infringed.
 void WebLocalFrameImpl::ReportContentSecurityPolicyViolation(
     const blink::WebContentSecurityPolicyViolation& violation) {
   AddMessageToConsole(blink::WebConsoleMessage(
       WebConsoleMessage::kLevelError, violation.console_message,
       violation.source_location.url, violation.source_location.line_number,
@@ skipping 432 matching lines @@
 TextCheckerClient& WebLocalFrameImpl::GetTextCheckerClient() const {
   return *text_checker_client_;
 }
 
 void WebLocalFrameImpl::SetTextCheckClient(
     WebTextCheckClient* text_check_client) {
   text_check_client_ = text_check_client;
 }
 
 }  // namespace blink