Make sure we never pass a null Frame to Document::canNavigate()

Source/core/frame/DOMWindow.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 938 matching lines @@
     Page* page = m_frame->page();
     if (!page)
         return;
 
     if (context) {
         ASSERT(isMainThread());
         Document* activeDocument = toDocument(context);
         if (!activeDocument)
             return;
 
-        if (!activeDocument->canNavigate(m_frame))
+        if (!activeDocument->canNavigate(*m_frame))
             return;
     }
 
     Settings* settings = m_frame->settings();
     bool allowScriptsToCloseWindows = settings && settings->allowScriptsToCloseWindows();
 
     if (!(page->openedByDOM() || page->backForward().backForwardListCount() <= 1 || allowScriptsToCloseWindows)) {
         frameConsole()->addMessage(JSMessageSource, WarningMessageLevel, "Scripts may close only the windows that were opened by it.");
         return;
     }
@@ skipping 681 matching lines @@
 
 void DOMWindow::setLocation(const String& urlString, DOMWindow* callingWindow, DOMWindow* enteredWindow, SetLocationLocking locking)
 {
     if (!isCurrentlyDisplayedInFrame())
         return;
 
     Document* activeDocument = callingWindow->document();
     if (!activeDocument)
         return;
 
-    if (!activeDocument->canNavigate(m_frame))
+    ASSERT(m_frame);
+    if (!activeDocument->canNavigate(*m_frame))
         return;
 
     LocalFrame* firstFrame = enteredWindow->frame();
     if (!firstFrame)
         return;
 
     KURL completedURL = firstFrame->document()->completeURL(urlString);
     if (completedURL.isNull())
         return;
 
@@ skipping 131 matching lines @@
     LocalFrame* targetFrame = 0;
     if (frameName == "_top")
         targetFrame = m_frame->tree().top();
     else if (frameName == "_parent") {
         if (LocalFrame* parent = m_frame->tree().parent())
             targetFrame = parent;
         else
             targetFrame = m_frame;
     }
     if (targetFrame) {
-        if (!activeDocument->canNavigate(targetFrame))
+        if (!activeDocument->canNavigate(*targetFrame))
             return nullptr;
 
         KURL completedURL = firstFrame->document()->completeURL(urlString);
 
         if (targetFrame->domWindow()->isInsecureScriptAccess(*callingWindow, completedURL))
             return targetFrame->domWindow();
 
         if (urlString.isEmpty())
             return targetFrame->domWindow();
 
@@ skipping 79 matching lines @@
     visitor->trace(m_sessionStorage);
     visitor->trace(m_localStorage);
     visitor->trace(m_applicationCache);
     visitor->trace(m_performance);
     visitor->trace(m_css);
     WillBeHeapSupplementable<DOMWindow>::trace(visitor);
     EventTargetWithInlineData::trace(visitor);
 }
 
 } // namespace WebCore