CSSStyleImageValue::imageLayoutSize() shouldn't crash if no ImageResourceContent

third_party/WebKit/Source/core/css/cssom/CSSStyleImageValue.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CSSStyleImageValue_h
 #define CSSStyleImageValue_h
 
 #include "core/CoreExport.h"
 #include "core/css/CSSImageValue.h"
 #include "core/css/CSSImageValue.h"
@@ skipping 38 matching lines @@
     visitor->trace(m_imageValue);
     CSSResourceValue::trace(visitor);
   }
 
  protected:
   CSSStyleImageValue(const CSSImageValue* imageValue)
       : m_imageValue(imageValue) {}
 
   virtual LayoutSize imageLayoutSize() const {
     DCHECK(!isCachePending());
-    return m_imageValue->cachedImage()->cachedImage()->imageSize(
-        DoNotRespectImageOrientation, 1, ImageResourceContent::IntrinsicSize);
+    ImageResourceContent* resourceContent =
+        m_imageValue->cachedImage()->cachedImage();
+    return resourceContent
+               ? resourceContent->imageSize(DoNotRespectImageOrientation, 1,
+                                            ImageResourceContent::IntrinsicSize)
+               : LayoutSize(0, 0);
   }
 
   virtual bool isCachePending() const { return m_imageValue->isCachePending(); }
 
   ResourceStatus status() const override {
     if (isCachePending())
       return ResourceStatus::NotStarted;
     return m_imageValue->cachedImage()->cachedImage()->getStatus();
   }
 
   const CSSImageValue* cssImageValue() const { return m_imageValue.get(); };
 
  private:
   PassRefPtr<Image> image() const;
 
   Member<const CSSImageValue> m_imageValue;
 };
 
 }  // namespace blink
 
 #endif  // CSSResourceValue_h