Don't assume every cell in a row has a column

third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp

Index: third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp
diff --git a/third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp b/third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp
index e4e53fff0e8652e4db32a32d6eaf8ad22b5ca79d..85cfd59807b1c23ebcbcd70b8d39bdd30037b0da 100644
--- a/third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp
+++ b/third_party/WebKit/Source/core/paint/BackgroundImageGeometry.cpp
@@ -332,10 +332,11 @@ static void expandToTableColumnGroup(const LayoutTableCell& cell,
                          : &LayoutTableCell::nextCell;
   for (const auto* sibling = (cell.*siblingCell)(); sibling;
        sibling = (sibling->*siblingCell)()) {
-    if (cell.table()
+    LayoutTableCol* innermostCol =
+        cell.table()
             ->colElementAtAbsoluteColumn(sibling->absoluteColumnIndex())
-            .innermostColOrColGroup()
-            ->enclosingColumnGroup() != columnGroup)
+            .innermostColOrColGroup();
+    if (!innermostCol || innermostCol->enclosingColumnGroup() != columnGroup)
       break;
     value += sibling->size().width();
   }