Make sure we never pass a null Frame to Document::canNavigate()

Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ skipping 1368 matching lines @@
     HTMLFrameOwnerElement* ownerElement = m_frame->ownerElement();
     if (!isHTMLIFrameElement(ownerElement))
         return false;
     return ownerElement->fastHasAttribute(srcdocAttr);
 }
 
 LocalFrame* FrameLoader::findFrameForNavigation(const AtomicString& name, Document* activeDocument)
 {
     ASSERT(activeDocument);
     LocalFrame* frame = m_frame->tree().find(name);
-    if (!activeDocument->canNavigate(frame))
+    if (!frame || !activeDocument->canNavigate(*frame))

[eseidel, 2014/06/02 05:19:29]

So this is the magic to fix the layout test?

[Inactive, 2014/06/02 12:16:37]

No, I did not do anything to fix the layout test. I think the comment was
outdated. In this part of the code, the function was returning 0 already if
frame was null:
- The if check would frame so it would do "return frame", frame being null.

Now, the if check succeeds, so it explicitly returns 0.

         return 0;
     return frame;
 }
 
 void FrameLoader::loadHistoryItem(HistoryItem* item, HistoryLoadType historyLoadType, ResourceRequestCachePolicy cachePolicy)
 {
     RefPtr<LocalFrame> protect(m_frame);
     if (m_frame->page()->defersLoading()) {
         m_deferredHistoryLoad = DeferredHistoryLoad(item, historyLoadType, cachePolicy);
         return;
@@ skipping 42 matching lines @@
     // FIXME: We need a way to propagate sandbox flags to out-of-process frames.
     Frame* parentFrame = m_frame->tree().parent();
     if (parentFrame && parentFrame->isLocalFrame())
         flags |= toLocalFrame(parentFrame)->document()->sandboxFlags();
     if (FrameOwner* frameOwner = m_frame->ownerElement())
         flags |= frameOwner->sandboxFlags();
     return flags;
 }
 
 } // namespace WebCore