Layout: Fix null-dereference in MenuListIntrinsicBlockSize()

Bug: 1108270
Change-Id: I7f2e5e9cc547342f580f8c87bae768981fa3341d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2318952
Auto-Submit: Kent Tamura <tkent@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#791723}

third_party/blink/renderer/core/layout/layout_box.cc

@@ -222,8 +222,10 @@ LayoutUnit MenuListIntrinsicBlockSize(const HTMLSelectElement& select,
     return kIndefiniteSize;
   const SimpleFontData* font_data = box.StyleRef().GetFont().PrimaryFont();
   DCHECK(font_data);
+  const LayoutBox* inner_box = select.InnerElement().GetLayoutBox();
   return (font_data ? font_data->GetFontMetrics().Height() : 0) +
-         select.InnerElement().GetLayoutBox()->BorderAndPaddingLogicalHeight();
+         (inner_box ? inner_box->BorderAndPaddingLogicalHeight()
+                    : LayoutUnit());
 }
 
 }  // anonymous namespace

third_party/blink/renderer/core/layout/layout_box_test.cc

@@ -1491,4 +1491,17 @@ TEST_P(LayoutBoxTest,
   DCHECK(!GetLayoutObjectByElementId("target")->NeedsLayout());
 }
 
+// crbug.com/1108270
+TEST_P(LayoutBoxTest, MenuListIntrinsicBlockSize) {
+  SetBodyInnerHTML(R"HTML(
+<style>
+.hidden { content-visibility: hidden; }
+</style>
+<select id=container class=hidden>
+)HTML");
+  GetDocument().View()->UpdateAllLifecyclePhasesExceptPaint(
+      DocumentUpdateReason ::kTest);
+  // The test passes if no crash.
+}
+
 }  // namespace blink