Fix crash in NavigationControllerImpl::RendererDidNavigateToNewPage

content/browser/frame_host/navigation_controller_impl.cc

Index: content/browser/frame_host/navigation_controller_impl.cc
diff --git a/content/browser/frame_host/navigation_controller_impl.cc b/content/browser/frame_host/navigation_controller_impl.cc
index bc83135fb80526cd793af60c9797a551487fb1f1..bcb370218277b8bcb1cad176a9a64d58450cb221 100644
--- a/content/browser/frame_host/navigation_controller_impl.cc
+++ b/content/browser/frame_host/navigation_controller_impl.cc
@@ -1060,7 +1060,7 @@ void NavigationControllerImpl::RendererDidNavigateToNewPage(
   // history.pushState() is classified as a navigation to a new page, but
   // sets was_within_same_page to true. In this case, we already have the
   // title available, so set it immediately.
-  if (params.was_within_same_page)
+  if (params.was_within_same_page && GetLastCommittedEntry())
     new_entry->SetTitle(GetLastCommittedEntry()->GetTitle());
 
   DCHECK(!params.history_list_was_cleared || !replace_entry);