Fix potential crash related to loading an invalid image URL

Source/core/loader/ImageLoader.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 250 matching lines @@
     updatedHasPendingEvent();
 }
 
 void ImageLoader::updateFromElement(LoadType loadType)
 {
     AtomicString attr = m_element->imageSourceURL();
 
     if (!m_failedLoadURL.isEmpty() && attr == m_failedLoadURL)
         return;
 
+    // If we have a pending task, we have to clear it -- either we're
+    // now loading immediately, or we need to reset the task's state.
+    if (m_pendingTask) {
+        m_pendingTask->clearLoader();
+        m_pendingTask.clear();
+    }
+
     KURL url = imageURL();
     if (!attr.isNull() && !url.isNull()) {
-        // If we have a pending task, we have to clear it -- either we're
-        // now loading immediately, or we need to reset the task's state.
-        if (m_pendingTask) {
-            m_pendingTask->clearLoader();
-            m_pendingTask.clear();
-        }
         bool loadImmediately = shouldLoadImmediately(url) || (loadType == ForceLoadImmediately);
         if (loadImmediately) {
             doUpdateFromElement(false);
         } else {
             OwnPtr<Task> task = adoptPtr(new Task(this));
             m_pendingTask = task->createWeakPtr();
             Microtask::enqueueMicrotask(task.release());
             m_delayLoad = adoptPtr(new IncrementLoadEventDelayCount(m_element->document()));
             return;
         }
@@ skipping 246 matching lines @@
 }
 
 #if ENABLE(OILPAN)
 ImageLoader::ImageLoaderClientRemover::~ImageLoaderClientRemover()
 {
     m_loader.willRemoveClient(m_client);
 }
 #endif
 
 }