Fix crash when using disallowed URLs in image sets for content CSS property

third_party/WebKit/Source/core/style/ContentData.h

 /*
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  *           (C) 2000 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2005, 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 58 matching lines @@
 };
 
 #define DEFINE_CONTENT_DATA_TYPE_CASTS(typeName) \
     DEFINE_TYPE_CASTS(typeName##ContentData, ContentData, content, content->is##typeName(), content.is##typeName())
 
 class ImageContentData final : public ContentData {
     friend class ContentData;
 public:
     const StyleImage* image() const { return m_image.get(); }
     StyleImage* image() { return m_image.get(); }
-    void setImage(PassRefPtrWillBeRawPtr<StyleImage> image) { m_image = image; }
+    void setImage(PassRefPtrWillBeRawPtr<StyleImage> image) { ASSERT(image); m_image = image; }
 
     bool isImage() const override { return true; }
     LayoutObject* createLayoutObject(Document&, ComputedStyle&) const override;
 
     bool equals(const ContentData& data) const override
     {
         if (!data.isImage())
             return false;
         return *static_cast<const ImageContentData&>(data).image() == *image();
     }
 
     DECLARE_VIRTUAL_TRACE();
 
 private:
     ImageContentData(PassRefPtrWillBeRawPtr<StyleImage> image)
         : m_image(image)
     {
+        ASSERT(m_image);
     }
 
     PassOwnPtrWillBeRawPtr<ContentData> cloneInternal() const override
     {
         RefPtrWillBeRawPtr<StyleImage> image = const_cast<StyleImage*>(this->image());
         return create(image.release());
     }
 
     RefPtrWillBeMember<StyleImage> m_image;
 };
@@ skipping 97 matching lines @@
 }
 
 inline bool operator!=(const ContentData& a, const ContentData& b)
 {
     return !(a == b);
 }
 
 } // namespace blink
 
 #endif // ContentData_h