Fix crash when setting invalid URL on content

third_party/WebKit/LayoutTests/fast/css/getComputedStyle/invalid-url-double-recalc-serialization.html

Index: third_party/WebKit/LayoutTests/fast/css/getComputedStyle/invalid-url-double-recalc-serialization.html
diff --git a/third_party/WebKit/LayoutTests/fast/css/getComputedStyle/disallowed-url-serialization.html b/third_party/WebKit/LayoutTests/fast/css/getComputedStyle/invalid-url-double-recalc-serialization.html
similarity index 52%
rename from third_party/WebKit/LayoutTests/fast/css/getComputedStyle/disallowed-url-serialization.html
rename to third_party/WebKit/LayoutTests/fast/css/getComputedStyle/invalid-url-double-recalc-serialization.html
index baee7c51b0f918cef0bc0eba765346d74db94098..ab2aa21a1cee451289af608a4c450d824db0d93a 100644
--- a/third_party/WebKit/LayoutTests/fast/css/getComputedStyle/disallowed-url-serialization.html
+++ b/third_party/WebKit/LayoutTests/fast/css/getComputedStyle/invalid-url-double-recalc-serialization.html
@@ -1,9 +1,9 @@
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
-<div id="target">
+<div id="target"></div>
 <script>
 var testCases = [
-  ['-webkit-box-reflect', 'below 0px url(\"chrome:\") 0 fill / auto / 0px stretch'],
+  ['-webkit-box-reflect', 'below 0px url("chrome:") 0 fill / auto / 0px stretch'],
   ['-webkit-mask-box-image-source', 'url("chrome:")'],
   ['-webkit-mask-image', 'url("chrome:")'],
   ['background-image', 'url("chrome:")'],
@@ -13,12 +13,17 @@ var testCases = [
 ];
 
 test(() => {
-  for ([property, value] of testCases) {
+  for (const [property, value] of testCases) {
     target.style[property] = value;
   }
   var computedStyle = getComputedStyle(target);
-  for ([property, value] of testCases) {
+  for (const [property, value] of testCases) {
     assert_equals(computedStyle[property], value, property);
   }
-}, 'Disallowed URL protocols should serialise as their original URL strings');
+  // Force a second style recalc so that the image gets cached and reused.
+  target.style.left = '0px'; // Force style recalc.
+  for (const [property, value] of testCases) {
+    assert_equals(computedStyle[property], value, property);
+  }
+}, 'Invalid URL protocols should serialise as their original URL strings after multiple recalcs');
 </script>