Ensure error page navigations don't get called back/foward without a HistoryItem

Bug: 784451
Change-Id: I62f97469bc9cf4c1aad0cc9ed5695b8a20012e18
Reviewed-on: https://chromium-review.googlesource.com/888262Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Commit-Queue: Nate Chapin <japhet@chromium.org>
Cr-Commit-Position: refs/heads/master@{#532674}

third_party/WebKit/Source/core/frame/WebLocalFrameImpl.cpp

@@ -2079,7 +2079,8 @@ void WebLocalFrameImpl::LoadData(const WebData& data,
     // When replacing a failed back/forward provisional navigation with an error
     // page, retain the HistoryItem for the failed provisional navigation
     // and reuse it for the error page navigation.
-    if (provisional_document_loader->LoadType() == kFrameLoadTypeBackForward) {
+    if (provisional_document_loader->LoadType() == kFrameLoadTypeBackForward &&
+        provisional_document_loader->GetHistoryItem()) {
       history_item = provisional_document_loader->GetHistoryItem();
       web_frame_load_type = WebFrameLoadType::kBackForward;
     }