Fix a NULL pointer access bug in TSFTextStore

ui/base/ime/win/tsf_text_store.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #define INITGUID  // required for GUID_PROP_INPUTSCOPE
 #include "ui/base/ime/win/tsf_text_store.h"
 
 #include <InputScope.h>
 #include <OleCtl.h>
 
@@ skipping 567 matching lines @@
 
   return S_OK;
 }
 
 STDMETHODIMP TSFTextStore::RequestSupportedAttrs(
     DWORD /* flags */,  // Seems that we should ignore this.
     ULONG attribute_buffer_size,
     const TS_ATTRID* attribute_buffer) {
   if (!attribute_buffer)
     return E_INVALIDARG;
+  if (!text_input_client_)
+    return E_FAIL;
   // We support only input scope attribute.
   for (size_t i = 0; i < attribute_buffer_size; ++i) {
     if (IsEqualGUID(GUID_PROP_INPUTSCOPE, attribute_buffer[i]))
       return S_OK;
   }
   return E_FAIL;
 }
 
 STDMETHODIMP TSFTextStore::RetrieveRequestedAttrs(
     ULONG attribute_buffer_size,
     TS_ATTRVAL* attribute_buffer,
     ULONG* attribute_buffer_copied) {
   if (!attribute_buffer_copied)
     return E_INVALIDARG;
   if (!attribute_buffer)
     return E_INVALIDARG;
+  if (!text_input_client_)
+    return E_UNEXPECTED;
   // We support only input scope attribute.
   *attribute_buffer_copied = 0;
   if (attribute_buffer_size == 0)
     return S_OK;
 
   attribute_buffer[0].dwOverlapId = 0;
   attribute_buffer[0].idAttr = GUID_PROP_INPUTSCOPE;
   attribute_buffer[0].varValue.vt = VT_UNKNOWN;
   attribute_buffer[0].varValue.punkVal = tsf_inputscope::CreateInputScope(
       text_input_client_->GetTextInputType(),
@@ skipping 295 matching lines @@
 
 bool TSFTextStore::HasReadLock() const {
   return (current_lock_type_ & TS_LF_READ) == TS_LF_READ;
 }
 
 bool TSFTextStore::HasReadWriteLock() const {
   return (current_lock_type_ & TS_LF_READWRITE) == TS_LF_READWRITE;
 }
 
 }  // namespace ui