Fix crash when content() url is -webkit-canvas

Source/core/html/HTMLImageElement.cpp

Index: Source/core/html/HTMLImageElement.cpp
diff --git a/Source/core/html/HTMLImageElement.cpp b/Source/core/html/HTMLImageElement.cpp
index f6d39f0c885c1a734ffba8092e779063de159c56..97407240427f5c3dccd481b505835439ea3a41ee 100644
--- a/Source/core/html/HTMLImageElement.cpp
+++ b/Source/core/html/HTMLImageElement.cpp
@@ -332,8 +332,12 @@ ImageCandidate HTMLImageElement::findBestFitImageFromPictureParent()
 LayoutObject* HTMLImageElement::createLayoutObject(const ComputedStyle& style)
 {
     const ContentData* contentData = style.contentData();
-    if (contentData && contentData->isImage() && !toImageContentData(contentData)->image()->cachedImage()->errorOccurred())
-        return LayoutObject::createObject(this, style);
+    if (contentData && contentData->isImage()) {
+        const StyleImage* contentImage = toImageContentData(contentData)->image();
+        bool errorOccurred = contentImage && contentImage->cachedImage() && contentImage->cachedImage()->errorOccurred();
+        if (!errorOccurred)
+            return LayoutObject::createObject(this, style);
+    }
 
     if (m_useFallbackContent)
         return new LayoutBlockFlow(this);