Use the correct node when hit testing on an image map

Source/core/layout/HitTestResult.cpp

 /*
  * Copyright (C) 2006, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 148 matching lines @@
     HTMLImageElement* imageElement = nullptr;
     if (isHTMLImageElement(m_innerNode)) {
         imageElement = toHTMLImageElement(m_innerNode);
     } else if (m_innerNode->isInShadowTree()) {
         if (m_innerNode->containingShadowRoot()->type() == ShadowRoot::UserAgentShadowRoot) {
             if (isHTMLImageElement(m_innerNode->shadowHost()))
                 imageElement = toHTMLImageElement(m_innerNode->shadowHost());
         }
     }
 
-    if (!imageElement)
+    if (!imageElement || !imageElement->layoutObject())
         return nullptr;
 
     HTMLMapElement* map = imageElement->treeScope().getImageMap(imageElement->fastGetAttribute(usemapAttr));
     if (!map)
         return nullptr;
 
-    LayoutBox* box = toLayoutBox(layoutObject());
+    LayoutBox* box = toLayoutBox(imageElement->layoutObject());
     LayoutRect contentBox = box->contentBoxRect();
     float scaleFactor = 1 / box->style()->effectiveZoom();
     LayoutPoint location = localPoint();
     location.scale(scaleFactor, scaleFactor);
 
     return map->areaForPoint(location, contentBox.size());
 }
 
 void HitTestResult::setInnerNode(Node* n)
 {
@@ skipping 322 matching lines @@
     else if (isHTMLMapElement(m_innerNode))
         imageMapImageElement = toHTMLMapElement(m_innerNode)->imageElement();
 
     if (!imageMapImageElement)
         return m_innerNode.get();
 
     return imageMapImageElement;
 }
 
 } // namespace blink