CSP: Null check if response_headers are present before parsing.

Bug: 759184
Change-Id: I13b092293ddfd0c78f2556452d4f4776591c3105
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1988918Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Commit-Queue: Lucas Gadani <lfg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#728787}

services/network/url_loader.cc

@@ -1008,8 +1008,10 @@ void URLLoader::OnResponseStarted(net::URLRequest* url_request, int net_error) {
           network::features::kOutOfBlinkFrameAncestors)) {
     // Parse the Content-Security-Policy headers.
     ContentSecurityPolicy policy;
-    if (policy.Parse(url_request_->url(), *url_request_->response_headers()))
+    if (url_request_->response_headers() &&
+        policy.Parse(url_request_->url(), *url_request_->response_headers())) {
       response_->content_security_policy = policy.TakeContentSecurityPolicy();
+    }
   }
 
   if (base::FeatureList::IsEnabled(features::kCrossOriginIsolation)) {