Add null check to fix crash in blink::ComputedStyle::display

third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp

Index: third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
diff --git a/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp b/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
index 2e6cbfa271035e812a5830f1702a98365fe032e6..0c3d434bcfce5bd72d11d30cf468a575b0d960ce 100644
--- a/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
@@ -800,8 +800,8 @@ static bool followBlockElementStyle(const Node* node)
         return false;
 
     const HTMLElement& element = toHTMLElement(*node);
-    return element.computedStyle()->display() == LIST_ITEM
-        || element.computedStyle()->display() == TABLE_CELL
+    return isListItem(node)
+        || isTableCell(node)
         || element.hasTagName(preTag)
         || element.hasTagName(h1Tag)
         || element.hasTagName(h2Tag)
@@ -831,7 +831,7 @@ static bool handleStyleSpansBeforeInsertion(ReplacementFragment& fragment, const
     // |node| can be an inline element like <br> under <li>
     // e.g.) editing/execCommand/switch-list-type.html
     //       editing/deleting/backspace-merge-into-block.html
-    if (node->computedStyle()->display() == INLINE) {
+    if (isInline(node)) {
         node = enclosingBlock(insertionPos.anchorNode());
         if (!node)
             return false;