Merge 116556 - [chromium] Check whether an active document loader exists before accessing it

Source/WebKit/chromium/src/FrameLoaderClientImpl.cpp

 /*
  * Copyright (C) 2009, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 616 matching lines @@
 void FrameLoaderClientImpl::dispatchDidNavigateWithinPage()
 {
     // Anchor fragment navigations are not normal loads, so we need to synthesize
     // some events for our delegate.
     WebViewImpl* webView = m_webFrame->viewImpl();
 
     // Flag of whether frame loader is completed. Generate didStartLoading and
     // didStopLoading only when loader is completed so that we don't fire
     // them for fragment redirection that happens in window.onload handler.
     // See https://bugs.webkit.org/show_bug.cgi?id=31838
-    bool loaderCompleted =
-        !webView->page()->mainFrame()->loader()->activeDocumentLoader()->isLoadingInAPISense();
+    //
+    // FIXME: Although FrameLoader::loadInSameDocument which invokes this
+    // method does not have a provisional document loader, we're seeing crashes
+    // where the FrameLoader is in provisional state, and thus
+    // activeDocumentLoader returns 0. Lacking any understanding of how this
+    // can happen, we do this check here to avoid crashing.
+    FrameLoader* loader = webView->page()->mainFrame()->loader();
+    bool loaderCompleted = !(loader->activeDocumentLoader() && loader->activeDocumentLoader()->isLoadingInAPISense());
 
     // Generate didStartLoading if loader is completed.
     if (webView->client() && loaderCompleted)
         webView->client()->didStartLoading();
 
     // We need to classify some hash changes as client redirects.
     // FIXME: It seems wrong that the currentItem can sometimes be null.
     HistoryItem* currentItem = m_webFrame->frame()->loader()->history()->currentItem();
     bool isHashChange = !currentItem || !currentItem->stateObject();
 
@@ skipping 952 matching lines @@
     m_webFrame->client()->dispatchIntent(webFrame(), intentRequest);
 }
 #endif
 
 void FrameLoaderClientImpl::dispatchWillOpenSocketStream(SocketStreamHandle* handle)
 {
     m_webFrame->client()->willOpenSocketStream(SocketStreamHandleInternal::toWebSocketStreamHandle(handle));
 }
 
 } // namespace WebKit