Fix nullptr deref in maybeRenderFallbackContent()

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 12061f72a43b7fd2785afab72ff4b29e7c7bb676..de6cb30d0c00860ed0ad0ebd7519fd61546b1110 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -5268,7 +5268,15 @@ void RenderFrameImpl::OnFailedNavigation(
 
   // On load failure, a frame can ask its owner to render fallback content.
   // When that happens, don't load an error page.
+  bool was_loading = !frame_->isLoading();

[arthursonzogni, 2017/04/05 07:53:34]

This is wrong here.
You meant: bool was_loading = frame_->isLoading();
Without the "!"

[Nate Chapin, 2017/04/11 18:39:00]

Done.

   if (frame_->maybeRenderFallbackContent(error)) {
+    // If the frame wasn't loading but was fallback-elligible, the fallback
+    // content won't be shown. However, showing an error page isn't right
+    // either, as the frame has already been populated with something unrelated
+    // to this navigation failure. In that case, just send a stop IPC to the
+    // browser to unwind its state, and leave the frame as-is.
+    if (!was_loading)
+      Send(new FrameHostMsg_DidStopLoading(routing_id_));
     browser_side_navigation_pending_ = false;
     return;
   }