Check |m_image| before using in |LayoutListMarker::imageChanged()|

Check |m_image| before using in |LayoutListMarker::imageChanged()|

This CL fixed crash cause by css:
```
    cursor:url('?'),auto;
    display:list-item;
```

|LayoutObject::imageChanged()| can be shared by multiple image listeners, it could be invoked by other listeners (from base class) before we add our own listeners.

We should make sure the object is ready and the image is the expected image.

Example Crash Log:
#0 0x7f0b7e03def7 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#1 0x7f0b7aa78330 <unknown>
#2 0x7f0b7d98ae36 blink::LayoutListMarker::imageChanged()
#3 0x7f0b7d73002c blink::ImageResource::notifyObservers()
#4 0x7f0b7d72fb9e blink::ImageResource::updateImage()
#5 0x7f0b7d730240 blink::ImageResource::finish()
#6 0x7f0b7d74335c blink::ResourceFetcher::didFinishLoading()
#7 0x7f0b7d0426f1 content::WebURLLoaderImpl::Context::OnCompletedRequest()
#8 0x7f0b7d029de5 content::ResourceDispatcher::OnRequestComplete()
#9 0x7f0b7d02b395 _ZN3IPC8MessageTI32ResourceMsg_RequestComplete_MetaSt5tupleIJiN7content31ResourceRequestCompletionStatusEEEvE8DispatchINS3_18ResourceDispatcherES8_vMS8_FviRKS4_EEEbPKNS_7MessageEPT_PT0_PT1_T2_
#10 0x7f0b7d0283e2 content::ResourceDispatcher::DispatchMessage()
#11 0x7f0b7d027cdb content::ResourceDispatcher::OnMessageReceived()
#12 0x7f0b7bba92e9 _ZN4base8internal7InvokerINS0_9BindStateIPFvSt10unique_ptrIN6syncer22AttachmentStoreBackendESt14default_deleteIS5_EEEJNS0_13PassedWrapperIS8_EEEEEFvvEE3RunEPNS0_13BindStateBaseE
#13 0x7f0b7e0afdd6 base::debug::TaskAnnotator::RunTask()

BUG=627811
Committed: https://crrev.com/7f53d5050b3b72d11cfbceb54f49d0bba15de43a
Cr-Commit-Position: refs/heads/master@{#405595}

[chongz, 2016-07-14 18:19:25]

The CQ bit was checked by chongz@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-07-14 18:20:08]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[chongz, 2016-07-14 18:29:07]

Description was changed from

==========
Check |m_image| before using in LayoutListMarker::imageChanged

BUG=627811
==========

to

==========
Check |m_image| before using in |LayoutListMarker::imageChanged()|

|LayoutObject::imageChanged()| can be shared by multiple image listeners, it
could be invoked by other listeners (from base class) before we add our own
listeners.

We should make sure the object is ready and the image is the expected image.

BUG=627811
==========

[chongz, 2016-07-14 18:39:14]

Description was changed from

==========
Check |m_image| before using in |LayoutListMarker::imageChanged()|

|LayoutObject::imageChanged()| can be shared by multiple image listeners, it
could be invoked by other listeners (from base class) before we add our own
listeners.

We should make sure the object is ready and the image is the expected image.

BUG=627811
==========

to

==========
Check |m_image| before using in |LayoutListMarker::imageChanged()|

|LayoutObject::imageChanged()| can be shared by multiple image listeners, it
could be invoked by other listeners (from base class) before we add our own
listeners.

We should make sure the object is ready and the image is the expected image.

Example Crash Log:
#0 0x7f0b7e03def7 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#1 0x7f0b7aa78330 <unknown>
#2 0x7f0b7d98ae36 blink::LayoutListMarker::imageChanged()
#3 0x7f0b7d73002c blink::ImageResource::notifyObservers()
#4 0x7f0b7d72fb9e blink::ImageResource::updateImage()
#5 0x7f0b7d730240 blink::ImageResource::finish()
#6 0x7f0b7d74335c blink::ResourceFetcher::didFinishLoading()
#7 0x7f0b7d0426f1 content::WebURLLoaderImpl::Context::OnCompletedRequest()
#8 0x7f0b7d029de5 content::ResourceDispatcher::OnRequestComplete()
#9 0x7f0b7d02b395
_ZN3IPC8MessageTI32ResourceMsg_RequestComplete_MetaSt5tupleIJiN7content31ResourceRequestCompletionStatusEEEvE8DispatchINS3_18ResourceDispatcherES8_vMS8_FviRKS4_EEEbPKNS_7MessageEPT_PT0_PT1_T2_
#10 0x7f0b7d0283e2 content::ResourceDispatcher::DispatchMessage()
#11 0x7f0b7d027cdb content::ResourceDispatcher::OnMessageReceived()
#12 0x7f0b7bba92e9
_ZN4base8internal7InvokerINS0_9BindStateIPFvSt10unique_ptrIN6syncer22AttachmentStoreBackendESt14default_deleteIS5_EEEJNS0_13PassedWrapperIS8_EEEEEFvvEE3RunEPNS0_13BindStateBaseE
#13 0x7f0b7e0afdd6 base::debug::TaskAnnotator::RunTask()

BUG=627811
==========

[chongz, 2016-07-14 18:41:06]

Description was changed from

==========
Check |m_image| before using in |LayoutListMarker::imageChanged()|

|LayoutObject::imageChanged()| can be shared by multiple image listeners, it
could be invoked by other listeners (from base class) before we add our own
listeners.

We should make sure the object is ready and the image is the expected image.

Example Crash Log:
#0 0x7f0b7e03def7 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#1 0x7f0b7aa78330 <unknown>
#2 0x7f0b7d98ae36 blink::LayoutListMarker::imageChanged()
#3 0x7f0b7d73002c blink::ImageResource::notifyObservers()
#4 0x7f0b7d72fb9e blink::ImageResource::updateImage()
#5 0x7f0b7d730240 blink::ImageResource::finish()
#6 0x7f0b7d74335c blink::ResourceFetcher::didFinishLoading()
#7 0x7f0b7d0426f1 content::WebURLLoaderImpl::Context::OnCompletedRequest()
#8 0x7f0b7d029de5 content::ResourceDispatcher::OnRequestComplete()
#9 0x7f0b7d02b395
_ZN3IPC8MessageTI32ResourceMsg_RequestComplete_MetaSt5tupleIJiN7content31ResourceRequestCompletionStatusEEEvE8DispatchINS3_18ResourceDispatcherES8_vMS8_FviRKS4_EEEbPKNS_7MessageEPT_PT0_PT1_T2_
#10 0x7f0b7d0283e2 content::ResourceDispatcher::DispatchMessage()
#11 0x7f0b7d027cdb content::ResourceDispatcher::OnMessageReceived()
#12 0x7f0b7bba92e9
_ZN4base8internal7InvokerINS0_9BindStateIPFvSt10unique_ptrIN6syncer22AttachmentStoreBackendESt14default_deleteIS5_EEEJNS0_13PassedWrapperIS8_EEEEEFvvEE3RunEPNS0_13BindStateBaseE
#13 0x7f0b7e0afdd6 base::debug::TaskAnnotator::RunTask()

BUG=627811
==========

to

==========
Check |m_image| before using in |LayoutListMarker::imageChanged()|

This CL fixed crash cause by css:
```
    cursor:url('?'),auto;
    display:list-item;
```

|LayoutObject::imageChanged()| can be shared by multiple image listeners, it
could be invoked by other listeners (from base class) before we add our own
listeners.

We should make sure the object is ready and the image is the expected image.

Example Crash Log:
#0 0x7f0b7e03def7 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#1 0x7f0b7aa78330 <unknown>
#2 0x7f0b7d98ae36 blink::LayoutListMarker::imageChanged()
#3 0x7f0b7d73002c blink::ImageResource::notifyObservers()
#4 0x7f0b7d72fb9e blink::ImageResource::updateImage()
#5 0x7f0b7d730240 blink::ImageResource::finish()
#6 0x7f0b7d74335c blink::ResourceFetcher::didFinishLoading()
#7 0x7f0b7d0426f1 content::WebURLLoaderImpl::Context::OnCompletedRequest()
#8 0x7f0b7d029de5 content::ResourceDispatcher::OnRequestComplete()
#9 0x7f0b7d02b395
_ZN3IPC8MessageTI32ResourceMsg_RequestComplete_MetaSt5tupleIJiN7content31ResourceRequestCompletionStatusEEEvE8DispatchINS3_18ResourceDispatcherES8_vMS8_FviRKS4_EEEbPKNS_7MessageEPT_PT0_PT1_T2_
#10 0x7f0b7d0283e2 content::ResourceDispatcher::DispatchMessage()
#11 0x7f0b7d027cdb content::ResourceDispatcher::OnMessageReceived()
#12 0x7f0b7bba92e9
_ZN4base8internal7InvokerINS0_9BindStateIPFvSt10unique_ptrIN6syncer22AttachmentStoreBackendESt14default_deleteIS5_EEEJNS0_13PassedWrapperIS8_EEEEEFvvEE3RunEPNS0_13BindStateBaseE
#13 0x7f0b7e0afdd6 base::debug::TaskAnnotator::RunTask()

BUG=627811
==========

[chongz, 2016-07-14 18:44:49]

chongz@chromium.org changed reviewers:
+ eae@chromium.org

[chongz, 2016-07-14 18:44:49]

eae@ PTAL at this fix for the Canary crash, thanks!

[commit-bot: I haz the power, 2016-07-14 19:41:55]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-07-14 19:41:56]

Dry run: This issue passed the CQ dry run.

[eae, 2016-07-14 21:49:24]

OK, LGTM

[eae, 2016-07-14 21:58:51]

The CQ bit was checked by eae@chromium.org

[commit-bot: I haz the power, 2016-07-14 21:59:23]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-07-14 22:10:29]

Description was changed from

==========
Check |m_image| before using in |LayoutListMarker::imageChanged()|

This CL fixed crash cause by css:
```
    cursor:url('?'),auto;
    display:list-item;
```

|LayoutObject::imageChanged()| can be shared by multiple image listeners, it
could be invoked by other listeners (from base class) before we add our own
listeners.

We should make sure the object is ready and the image is the expected image.

Example Crash Log:
#0 0x7f0b7e03def7 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#1 0x7f0b7aa78330 <unknown>
#2 0x7f0b7d98ae36 blink::LayoutListMarker::imageChanged()
#3 0x7f0b7d73002c blink::ImageResource::notifyObservers()
#4 0x7f0b7d72fb9e blink::ImageResource::updateImage()
#5 0x7f0b7d730240 blink::ImageResource::finish()
#6 0x7f0b7d74335c blink::ResourceFetcher::didFinishLoading()
#7 0x7f0b7d0426f1 content::WebURLLoaderImpl::Context::OnCompletedRequest()
#8 0x7f0b7d029de5 content::ResourceDispatcher::OnRequestComplete()
#9 0x7f0b7d02b395
_ZN3IPC8MessageTI32ResourceMsg_RequestComplete_MetaSt5tupleIJiN7content31ResourceRequestCompletionStatusEEEvE8DispatchINS3_18ResourceDispatcherES8_vMS8_FviRKS4_EEEbPKNS_7MessageEPT_PT0_PT1_T2_
#10 0x7f0b7d0283e2 content::ResourceDispatcher::DispatchMessage()
#11 0x7f0b7d027cdb content::ResourceDispatcher::OnMessageReceived()
#12 0x7f0b7bba92e9
_ZN4base8internal7InvokerINS0_9BindStateIPFvSt10unique_ptrIN6syncer22AttachmentStoreBackendESt14default_deleteIS5_EEEJNS0_13PassedWrapperIS8_EEEEEFvvEE3RunEPNS0_13BindStateBaseE
#13 0x7f0b7e0afdd6 base::debug::TaskAnnotator::RunTask()

BUG=627811
==========

to

==========
Check |m_image| before using in |LayoutListMarker::imageChanged()|

This CL fixed crash cause by css:
```
    cursor:url('?'),auto;
    display:list-item;
```

|LayoutObject::imageChanged()| can be shared by multiple image listeners, it
could be invoked by other listeners (from base class) before we add our own
listeners.

We should make sure the object is ready and the image is the expected image.

Example Crash Log:
#0 0x7f0b7e03def7 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#1 0x7f0b7aa78330 <unknown>
#2 0x7f0b7d98ae36 blink::LayoutListMarker::imageChanged()
#3 0x7f0b7d73002c blink::ImageResource::notifyObservers()
#4 0x7f0b7d72fb9e blink::ImageResource::updateImage()
#5 0x7f0b7d730240 blink::ImageResource::finish()
#6 0x7f0b7d74335c blink::ResourceFetcher::didFinishLoading()
#7 0x7f0b7d0426f1 content::WebURLLoaderImpl::Context::OnCompletedRequest()
#8 0x7f0b7d029de5 content::ResourceDispatcher::OnRequestComplete()
#9 0x7f0b7d02b395
_ZN3IPC8MessageTI32ResourceMsg_RequestComplete_MetaSt5tupleIJiN7content31ResourceRequestCompletionStatusEEEvE8DispatchINS3_18ResourceDispatcherES8_vMS8_FviRKS4_EEEbPKNS_7MessageEPT_PT0_PT1_T2_
#10 0x7f0b7d0283e2 content::ResourceDispatcher::DispatchMessage()
#11 0x7f0b7d027cdb content::ResourceDispatcher::OnMessageReceived()
#12 0x7f0b7bba92e9
_ZN4base8internal7InvokerINS0_9BindStateIPFvSt10unique_ptrIN6syncer22AttachmentStoreBackendESt14default_deleteIS5_EEEJNS0_13PassedWrapperIS8_EEEEEFvvEE3RunEPNS0_13BindStateBaseE
#13 0x7f0b7e0afdd6 base::debug::TaskAnnotator::RunTask()

BUG=627811
==========

[commit-bot: I haz the power, 2016-07-14 22:10:31]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-07-14 22:14:43]

Description was changed from

==========
Check |m_image| before using in |LayoutListMarker::imageChanged()|

This CL fixed crash cause by css:
```
    cursor:url('?'),auto;
    display:list-item;
```

|LayoutObject::imageChanged()| can be shared by multiple image listeners, it
could be invoked by other listeners (from base class) before we add our own
listeners.

We should make sure the object is ready and the image is the expected image.

Example Crash Log:
#0 0x7f0b7e03def7 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#1 0x7f0b7aa78330 <unknown>
#2 0x7f0b7d98ae36 blink::LayoutListMarker::imageChanged()
#3 0x7f0b7d73002c blink::ImageResource::notifyObservers()
#4 0x7f0b7d72fb9e blink::ImageResource::updateImage()
#5 0x7f0b7d730240 blink::ImageResource::finish()
#6 0x7f0b7d74335c blink::ResourceFetcher::didFinishLoading()
#7 0x7f0b7d0426f1 content::WebURLLoaderImpl::Context::OnCompletedRequest()
#8 0x7f0b7d029de5 content::ResourceDispatcher::OnRequestComplete()
#9 0x7f0b7d02b395
_ZN3IPC8MessageTI32ResourceMsg_RequestComplete_MetaSt5tupleIJiN7content31ResourceRequestCompletionStatusEEEvE8DispatchINS3_18ResourceDispatcherES8_vMS8_FviRKS4_EEEbPKNS_7MessageEPT_PT0_PT1_T2_
#10 0x7f0b7d0283e2 content::ResourceDispatcher::DispatchMessage()
#11 0x7f0b7d027cdb content::ResourceDispatcher::OnMessageReceived()
#12 0x7f0b7bba92e9
_ZN4base8internal7InvokerINS0_9BindStateIPFvSt10unique_ptrIN6syncer22AttachmentStoreBackendESt14default_deleteIS5_EEEJNS0_13PassedWrapperIS8_EEEEEFvvEE3RunEPNS0_13BindStateBaseE
#13 0x7f0b7e0afdd6 base::debug::TaskAnnotator::RunTask()

BUG=627811
==========

to

==========
Check |m_image| before using in |LayoutListMarker::imageChanged()|

This CL fixed crash cause by css:
```
    cursor:url('?'),auto;
    display:list-item;
```

|LayoutObject::imageChanged()| can be shared by multiple image listeners, it
could be invoked by other listeners (from base class) before we add our own
listeners.

We should make sure the object is ready and the image is the expected image.

Example Crash Log:
#0 0x7f0b7e03def7 base::debug::(anonymous namespace)::StackDumpSignalHandler()
#1 0x7f0b7aa78330 <unknown>
#2 0x7f0b7d98ae36 blink::LayoutListMarker::imageChanged()
#3 0x7f0b7d73002c blink::ImageResource::notifyObservers()
#4 0x7f0b7d72fb9e blink::ImageResource::updateImage()
#5 0x7f0b7d730240 blink::ImageResource::finish()
#6 0x7f0b7d74335c blink::ResourceFetcher::didFinishLoading()
#7 0x7f0b7d0426f1 content::WebURLLoaderImpl::Context::OnCompletedRequest()
#8 0x7f0b7d029de5 content::ResourceDispatcher::OnRequestComplete()
#9 0x7f0b7d02b395
_ZN3IPC8MessageTI32ResourceMsg_RequestComplete_MetaSt5tupleIJiN7content31ResourceRequestCompletionStatusEEEvE8DispatchINS3_18ResourceDispatcherES8_vMS8_FviRKS4_EEEbPKNS_7MessageEPT_PT0_PT1_T2_
#10 0x7f0b7d0283e2 content::ResourceDispatcher::DispatchMessage()
#11 0x7f0b7d027cdb content::ResourceDispatcher::OnMessageReceived()
#12 0x7f0b7bba92e9
_ZN4base8internal7InvokerINS0_9BindStateIPFvSt10unique_ptrIN6syncer22AttachmentStoreBackendESt14default_deleteIS5_EEEJNS0_13PassedWrapperIS8_EEEEEFvvEE3RunEPNS0_13BindStateBaseE
#13 0x7f0b7e0afdd6 base::debug::TaskAnnotator::RunTask()

BUG=627811

Committed: https://crrev.com/7f53d5050b3b72d11cfbceb54f49d0bba15de43a
Cr-Commit-Position: refs/heads/master@{#405595}
==========

[commit-bot: I haz the power, 2016-07-14 22:14:44]

Patchset 1 (id:??) landed as
https://crrev.com/7f53d5050b3b72d11cfbceb54f49d0bba15de43a
Cr-Commit-Position: refs/heads/master@{#405595}