Avoid crash in HistoryNode::CloneAndReplace with out-of-process iframes.

content/renderer/history_entry.cc

Index: content/renderer/history_entry.cc
diff --git a/content/renderer/history_entry.cc b/content/renderer/history_entry.cc
index d1425165a877fdb1b8705dc14eba14dc27bb88a8..7686165f4eea2c131e1cb51a800383429b6277f9 100644
--- a/content/renderer/history_entry.cc
+++ b/content/renderer/history_entry.cc
@@ -86,6 +86,11 @@ HistoryEntry::HistoryNode* HistoryEntry::HistoryNode::CloneAndReplace(
          child = child->nextSibling()) {
       RenderFrameImpl* child_render_frame =
           RenderFrameImpl::FromWebFrame(child);
+      // TODO(creis): A child frame may be a RenderFrameProxy.  We should still
+      // process its children, but that will be possible when we move this code
+      // to the browser process in https://crbug.com/236848.
+      if (!child_render_frame)
+        continue;
       HistoryNode* child_history_node =
           entry_->GetHistoryNodeForFrame(child_render_frame);
       if (!child_history_node)