Fix crash when content() url is -webkit-canvas

Source/core/html/HTMLImageElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 314 matching lines @@
         if (candidate.isEmpty())
             continue;
         return candidate;
     }
     return ImageCandidate();
 }
 
 LayoutObject* HTMLImageElement::createLayoutObject(const ComputedStyle& style)
 {
     const ContentData* contentData = style.contentData();
-    if (contentData && contentData->isImage() && !toImageContentData(contentData)->image()->cachedImage()->errorOccurred())
-        return LayoutObject::createObject(this, style);
+    if (contentData && contentData->isImage()) {
+        const StyleImage* contentImage = toImageContentData(contentData)->image();
+        bool errorOccurred = contentImage && contentImage->cachedImage() && contentImage->cachedImage()->errorOccurred();
+        if (!errorOccurred)
+            return LayoutObject::createObject(this, style);
+    }
 
     if (m_useFallbackContent)
         return new LayoutBlockFlow(this);
 
     LayoutImage* image = new LayoutImage(this);
     image->setImageResource(LayoutImageResource::create());
     image->setImageDevicePixelRatio(m_imageDevicePixelRatio);
     return image;
 }
 
@@ skipping 406 matching lines @@
     ensureUserAgentShadowRoot();
 }
 
 bool HTMLImageElement::isOpaque() const
 {
     Image* image = const_cast<HTMLImageElement*>(this)->imageContents();
     return image && image->currentFrameKnownToBeOpaque();
 }
 
 }