HTMLImageElement::cachedImage() may return null in ImageDocument construction

third_party/WebKit/Source/core/html/ImageDocument.cpp

Index: third_party/WebKit/Source/core/html/ImageDocument.cpp
diff --git a/third_party/WebKit/Source/core/html/ImageDocument.cpp b/third_party/WebKit/Source/core/html/ImageDocument.cpp
index 845152f0d3de10c18d6022ea074d79a59a661c3c..842ceb13abda40c7166c8ef164ec99b65312cfe9 100644
--- a/third_party/WebKit/Source/core/html/ImageDocument.cpp
+++ b/third_party/WebKit/Source/core/html/ImageDocument.cpp
@@ -227,7 +227,7 @@ void ImageDocument::createDocumentStructure()
     m_imageElement->setLoadingImageDocument();
     m_imageElement->setSrc(url().getString());
     body->appendChild(m_imageElement.get());
-    if (loader())
+    if (loader() && m_imageElement->cachedImage())

[Nate Chapin, 2016/03/15 21:27:53]

Do we know why this can be null? It's not immediately obvious to me how that can
happen.

[yhirano, 2016/03/16 08:40:48]

ImageResource::fetch can return null. In ImageLoader[1] we are checking it after
creating an ImageResource which is the ImageResource returned from
m_imageElement->cachedImage().

I can create a crashing example locally with devtool's experimental "URL
blocking" functionality[2], though adding a layout test looks difficult.

1:
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...
2:
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...

         m_imageElement->cachedImage()->responseReceived(loader()->response(), nullptr);
 
     if (shouldShrinkToFit()) {