in EventHandler.cpp:1081 image is NULL. looks like the old code would continue if (!cimage)
Created attachment 71231 [details] Patch
This fixes the crashes, but it doesn't include a regression test as I'm not sure how to construct one. The null check in EventHandler.cpp is needed to avoid the crash on startup, the check in CSSComputedStyleDeclaration.cpp is needed so it doesn't crash when opening the inspector. The rest of the changes are by inspection. This doesn't appear to regress the existing manual tests. Any ideas on how to construct regression tests? I know very little about cursors. FYI this is one of the top 5 crashers in Chromium nightlies.
The page in question has body { cursor: url(''), url('http://img715.imageshack.us/img715/4435/cur.png'), auto; } so we should be able to mimic this in a manual test.
Created attachment 71608 [details] Patch
Comment on attachment 71608 [details] Patch yay!
Committed r70365: <http://trac.webkit.org/changeset/70365>