Speculative fix for null m_documentLoader deref in FrameLoader::loadInSameDocument

Source/core/loader/FrameLoader.cpp

Index: Source/core/loader/FrameLoader.cpp
diff --git a/Source/core/loader/FrameLoader.cpp b/Source/core/loader/FrameLoader.cpp
index 16fb7acdb782495a4337dab7a859b962196ba1ef..04d15f2f7cee37f4133a7c25a32afc3a775e2b2f 100644
--- a/Source/core/loader/FrameLoader.cpp
+++ b/Source/core/loader/FrameLoader.cpp
@@ -1393,6 +1393,12 @@ LocalFrame* FrameLoader::findFrameForNavigation(const AtomicString& name, Docume
 void FrameLoader::loadHistoryItem(HistoryItem* item, HistoryLoadType historyLoadType, ResourceRequestCachePolicy cachePolicy)
 {
     RefPtr<LocalFrame> protect(m_frame);
+    // FIXME: It shouldn't be possible for m_documentLoader to be null without m_frame->page() also being null.
+    // However, it does appear to happen occasionally. This sounds like a side-effect of reentrant frame detach.
+    // See detachClient().

[dcheng, 2014/05/29 22:43:44]

I don't quite understand this comment. Do we check that m_frame->page() is not
null somewhere before we call this?

+    if (!m_documentLoader)
+        return;
+
     if (m_frame->page()->defersLoading()) {
         m_deferredHistoryLoad = DeferredHistoryLoad(item, historyLoadType, cachePolicy);
         return;