Fix crash when using disallowed URLs in image sets for content CSS property

third_party/WebKit/Source/core/css/CSSCursorImageValue.cpp

 /*
  * Copyright (C) 2006 Rob Buis <buis@kde.org>
  *           (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 110 matching lines @@
     if (m_imageValue->isImageSetValue())
         return toCSSImageSetValue(*m_imageValue).isCachePending(deviceScaleFactor);
     return m_isCachePending;
 }
 
 StyleImage* CSSCursorImageValue::cachedImage(float deviceScaleFactor) const
 {
     ASSERT(!isCachePending(deviceScaleFactor));
 
     if (m_imageValue->isImageSetValue())
-        return toCSSImageSetValue(*m_imageValue).cachedImageSet(deviceScaleFactor);
+        return toCSSImageSetValue(*m_imageValue).cachedImage(deviceScaleFactor);
     return m_cachedImage.get();
 }
 
 StyleImage* CSSCursorImageValue::cacheImage(Document* document, float deviceScaleFactor)
 {
     if (m_imageValue->isImageSetValue())
-        return toCSSImageSetValue(*m_imageValue).cacheImageSet(document, deviceScaleFactor);
+        return toCSSImageSetValue(*m_imageValue).cacheImage(document, deviceScaleFactor);
 
     if (m_isCachePending) {
         m_isCachePending = false;
 
         // For SVG images we need to lazily substitute in the correct URL. Rather than attempt
         // to change the URL of the CSSImageValue (which would then change behavior like cssText),
         // we create an alternate CSSImageValue to use.
         if (isSVGCursor() && document) {
             RefPtrWillBeRawPtr<CSSImageValue> imageValue = toCSSImageValue(m_imageValue.get());
             // FIXME: This will fail if the <cursor> element is in a shadow DOM (bug 59827)
@@ skipping 51 matching lines @@
 }
 
 DEFINE_TRACE_AFTER_DISPATCH(CSSCursorImageValue)
 {
     visitor->trace(m_imageValue);
     visitor->trace(m_cachedImage);
     CSSValue::traceAfterDispatch(visitor);
 }
 
 } // namespace blink