Check |m_image| before using in |LayoutListMarker::imageChanged()|

third_party/WebKit/Source/core/layout/LayoutListMarker.cpp

Index: third_party/WebKit/Source/core/layout/LayoutListMarker.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutListMarker.cpp b/third_party/WebKit/Source/core/layout/LayoutListMarker.cpp
index dc47aca32637ddfd6022683e918d8f4df7ddab39..144904feb395a46ec30114443a9bcb9b5165a966 100644
--- a/third_party/WebKit/Source/core/layout/LayoutListMarker.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutListMarker.cpp
@@ -163,7 +163,7 @@ void LayoutListMarker::layout()
 void LayoutListMarker::imageChanged(WrappedImagePtr o, const IntRect*)
 {
     // A list marker can't have a background or border image, so no need to call the base class method.
-    if (o != m_image->data())
+    if (!m_image || o != m_image->data())
         return;
 
     LayoutSize imageSize = isImage() ? imageBulletSize() : LayoutSize();