Avoid crash in HistoryNode::CloneAndReplace with out-of-process iframes.

content/renderer/history_entry.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  *     (http://www.torchmobile.com/)
  *
@@ skipping 68 matching lines @@
   if (is_target_frame && clone_children_of_target && !item_.isNull()) {
     new_history_node->item().setDocumentSequenceNumber(
         item_.documentSequenceNumber());
   }
 
   if (clone_children_of_target || !is_target_frame) {
     for (WebFrame* child = current_frame->GetWebFrame()->firstChild(); child;
          child = child->nextSibling()) {
       RenderFrameImpl* child_render_frame =
           RenderFrameImpl::FromWebFrame(child);
+      // TODO(creis): A child frame may be a RenderFrameProxy.  We should still
+      // process its children, but that will be possible when we move this code
+      // to the browser process in https://crbug.com/236848.
+      if (!child_render_frame)
+        continue;
       HistoryNode* child_history_node =
           entry_->GetHistoryNodeForFrame(child_render_frame);
       if (!child_history_node)
         continue;
       HistoryNode* new_child_node =
           child_history_node->CloneAndReplace(new_entry,
                                               new_item,
                                               clone_children_of_target,
                                               target_frame,
                                               child_render_frame);
@@ skipping 102 matching lines @@
   return unique_names_to_items_[frame->GetWebFrame()->uniqueName().utf8()];
 }
 
 WebHistoryItem HistoryEntry::GetItemForFrame(RenderFrameImpl* frame) {
   if (HistoryNode* history_node = GetHistoryNodeForFrame(frame))
     return history_node->item();
   return WebHistoryItem();
 }
 
 }  // namespace content