Speculative fix for null m_documentLoader deref in FrameLoader::loadInSameDocument

Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ skipping 1375 matching lines @@
     ASSERT(activeDocument);
     LocalFrame* frame = m_frame->tree().find(name);
     if (!activeDocument->canNavigate(frame))
         return 0;
     return frame;
 }
 
 void FrameLoader::loadHistoryItem(HistoryItem* item, HistoryLoadType historyLoadType, ResourceRequestCachePolicy cachePolicy)
 {
     RefPtr<LocalFrame> protect(m_frame);
+    // FIXME: It shouldn't be possible for m_documentLoader to be null without m_frame->page() also being null.
+    // However, it does appear to happen occasionally. This sounds like a side-effect of reentrant frame detach.
+    // See detachClient().

[dcheng, 2014/05/29 22:43:44]

I don't quite understand this comment. Do we check that m_frame->page() is not
null somewhere before we call this?

+    if (!m_documentLoader)
+        return;
+
     if (m_frame->page()->defersLoading()) {
         m_deferredHistoryLoad = DeferredHistoryLoad(item, historyLoadType, cachePolicy);
         return;
     }
 
     m_provisionalItem = item;
     if (historyLoadType == HistorySameDocumentLoad) {
         m_loadType = FrameLoadTypeBackForward;
         loadInSameDocument(item->url(), item->stateObject(), FrameLoadTypeBackForward, NotClientRedirect);
         restoreScrollPositionAndViewState();
@@ skipping 33 matching lines @@
 {
     SandboxFlags flags = m_forcedSandboxFlags;
     if (LocalFrame* parentFrame = m_frame->tree().parent())
         flags |= parentFrame->document()->sandboxFlags();
     if (FrameOwner* frameOwner = m_frame->ownerElement())
         flags |= frameOwner->sandboxFlags();
     return flags;
 }
 
 } // namespace WebCore