Fix crash by img[ismap] with content property
https://bugs.webkit.org/show_bug.cgi?id=108702

Reviewed by Adam Barth.

Source/WebCore:

Test: fast/dom/HTMLAnchorElement/anchor-ismap-crash.html

* html/HTMLAnchorElement.cpp:
(WebCore::appendServerMapMousePosition):
Check if the renderer of an img element is RenderImage.

LayoutTests:

* fast/dom/HTMLAnchorElement/anchor-ismap-crash-expected.txt: Added.
* fast/dom/HTMLAnchorElement/anchor-ismap-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142358 268f45cc-cd09-0410-ab3c-d52691b4dbfc