[blink] Avoid null pointer dereference in HitTestResult::isMisspelled()

Source/core/rendering/HitTestResult.cpp

Index: Source/core/rendering/HitTestResult.cpp
diff --git a/Source/core/rendering/HitTestResult.cpp b/Source/core/rendering/HitTestResult.cpp
index ac573ea9cd33a44a8d8eb126017e452b81b5896b..cb2458dc1b83265141a575f1b31084befc20ee5c 100644
--- a/Source/core/rendering/HitTestResult.cpp
+++ b/Source/core/rendering/HitTestResult.cpp
@@ -347,7 +347,7 @@ bool HitTestResult::isLiveLink() const
 
 bool HitTestResult::isMisspelled() const
 {
-    if (!targetNode())
+    if (!targetNode() || !targetNode()->renderer())

[eseidel, 2014/02/25 00:30:02]

I'm surprised that we'd have a HitTestResult which did not have an associated
renderer?  Are you sure there aren't other parts of the code which assume this? 
Do other pathways in HitTestResult check for a renderer?

[please use gerrit instead, 2014/02/25 01:14:53]

So was I. :-)
The other methods in HitTestResult check for renderer() before using a node. See
for example:

HitTestResult::spellingToolTip()
HitTestResult::title()
HitTestResult::image()
etc

         return false;
     VisiblePosition pos(targetNode()->renderer()->positionForPoint(localPoint()));
     if (pos.isNull())