Speculative fix for History::SetScrollRestoration crash

Bug: 1139878
Change-Id: I3a86211116391a536e4b3e7631e30c825cc162fb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2485628
Commit-Queue: Kentaro Hara <haraken@chromium.org>
Auto-Submit: Nate Chapin <japhet@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#818973}

third_party/blink/renderer/core/frame/history.cc

@@ -123,7 +123,8 @@ SerializedScriptValue* History::StateInternal() const {
 void History::setScrollRestoration(const String& value,
                                    ExceptionState& exception_state) {
   DCHECK(value == "manual" || value == "auto");
-  if (!DomWindow()) {
+  HistoryItem* item = GetHistoryItem();
+  if (!item) {
     exception_state.ThrowSecurityError(
         "May not use a History object associated with a Document that is not "
         "fully active");
@@ -136,7 +137,7 @@ void History::setScrollRestoration(const String& value,
   if (scroll_restoration == ScrollRestorationInternal())
     return;
 
-  GetHistoryItem()->SetScrollRestorationType(scroll_restoration);
+  item->SetScrollRestorationType(scroll_restoration);
   DomWindow()->GetFrame()->Client()->DidUpdateCurrentHistoryItem();
 }