WebFrameLoaderClient::dispatchDidFailProvisionalLoad() calls the InjectedBundleLoaderClient's didFailProvisionalLoadWithErrorForFrame() before sending a message to the UI process that a provisional load has failed. It's possible for the provisional document loader to become null while calling into the InjectedBundleLoaderClient (as is the case with the WebKitTestRunner's injected bundle), leading to a null dereference when trying to send the DidFailProvisionalLoadForFrame message.
Created attachment 231921 [details] Patch
Comment on attachment 231921 [details] Patch Any way to API test this?
(In reply to comment #2) > (From update of attachment 231921 [details]) > Any way to API test this? Yes, I think so. I'm working on that now.
Comment on attachment 231921 [details] Patch Clearing flags on attachment: 231921 Committed r169315: <http://trac.webkit.org/changeset/169315>
All reviewed patches have been landed. Closing bug.
<rdar://problem/17042850>