Add null check to fix crash in blink::ComputedStyle::display

third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp

 /*
  * Copyright (C) 2005, 2006, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2009, 2010, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 782 matching lines @@
         }
     }
 }
 
 static bool followBlockElementStyle(const Node* node)
 {
     if (!node->isHTMLElement())
         return false;
 
     const HTMLElement& element = toHTMLElement(*node);
-    return element.computedStyle()->display() == LIST_ITEM
-        || element.computedStyle()->display() == TABLE_CELL
+    return isListItem(node)
+        || isTableCell(node)
         || element.hasTagName(preTag)
         || element.hasTagName(h1Tag)
         || element.hasTagName(h2Tag)
         || element.hasTagName(h3Tag)
         || element.hasTagName(h4Tag)
         || element.hasTagName(h5Tag)
         || element.hasTagName(h6Tag);
 }
 
 // Remove style spans before insertion if they are unnecessary.  It's faster because we'll
 // avoid doing a layout.
 static bool handleStyleSpansBeforeInsertion(ReplacementFragment& fragment, const Position& insertionPos)
 {
     Node* topNode = fragment.firstChild();
     if (!isHTMLSpanElement(topNode))
         return false;
 
     // Handling the case where we are doing Paste as Quotation or pasting into quoted content is more complicated (see handleStyleSpans)
     // and doesn't receive the optimization.
     if (isMailPasteAsQuotationHTMLBlockQuoteElement(topNode) || enclosingNodeOfType(firstPositionInOrBeforeNode(topNode), isMailHTMLBlockquoteElement, CanCrossEditingBoundary))
         return false;
 
     // Remove style spans to follow the styles of parent block element when |fragment| becomes a part of it.
     // See bugs http://crbug.com/226941 and http://crbug.com/335955.
     HTMLSpanElement* wrappingStyleSpan = toHTMLSpanElement(topNode);
     const Node* node = insertionPos.anchorNode();
     // |node| can be an inline element like <br> under <li>
     // e.g.) editing/execCommand/switch-list-type.html
     //       editing/deleting/backspace-merge-into-block.html
-    if (node->computedStyle()->display() == INLINE) {
+    if (isInline(node)) {
         node = enclosingBlock(insertionPos.anchorNode());
         if (!node)
             return false;
     }
 
     if (followBlockElementStyle(node)) {
         fragment.removeNodePreservingChildren(wrappingStyleSpan);
         return true;
     }
 
@@ skipping 911 matching lines @@
     visitor->trace(m_startOfInsertedContent);
     visitor->trace(m_endOfInsertedContent);
     visitor->trace(m_insertionStyle);
     visitor->trace(m_documentFragment);
     visitor->trace(m_startOfInsertedRange);
     visitor->trace(m_endOfInsertedRange);
     CompositeEditCommand::trace(visitor);
 }
 
 } // namespace blink