Merge 94905 - Source/WebCore: Crash due to bad data in SVGDocumentExtensions m_pendingResources

Source/WebCore/svg/SVGDocumentExtensions.cpp

Index: Source/WebCore/svg/SVGDocumentExtensions.cpp
===================================================================
--- Source/WebCore/svg/SVGDocumentExtensions.cpp	(revision 95993)
+++ Source/WebCore/svg/SVGDocumentExtensions.cpp	(working copy)
@@ -227,7 +227,7 @@
         m_pendingResources.add(id, set);
     }
 
-    element->setHasPendingResources(true);
+    element->setHasPendingResources();
 }
 
 bool SVGDocumentExtensions::hasPendingResources(const AtomicString& id) const
@@ -238,6 +238,24 @@
     return m_pendingResources.contains(id);
 }
 
+bool SVGDocumentExtensions::isElementInPendingResources(SVGStyledElement* element) const
+{
+    ASSERT(element);
+
+    if (m_pendingResources.isEmpty())
+        return false;
+
+    HashMap<AtomicString, SVGPendingElements*>::const_iterator end = m_pendingResources.end();
+    for (HashMap<AtomicString, SVGPendingElements*>::const_iterator it = m_pendingResources.begin(); it != end; ++it) {
+        SVGPendingElements* elements = it->second;
+        ASSERT(elements);
+
+        if (elements->contains(element))
+            return true;
+    }
+    return false;
+}
+
 void SVGDocumentExtensions::removeElementFromPendingResources(SVGStyledElement* element)
 {
     ASSERT(element);
@@ -245,8 +263,6 @@
     if (m_pendingResources.isEmpty() || !element->hasPendingResources())
         return;
 
-    element->setHasPendingResources(false);
-
     Vector<AtomicString> toBeRemoved;
     HashMap<AtomicString, SVGPendingElements*>::iterator end = m_pendingResources.end();
     for (HashMap<AtomicString, SVGPendingElements*>::iterator it = m_pendingResources.begin(); it != end; ++it) {
@@ -259,6 +275,8 @@
             toBeRemoved.append(it->first);
     }
 
+    element->clearHasPendingResourcesIfPossible();
+
     if (toBeRemoved.isEmpty())
         return;
 
Property changes on: Source\WebCore\svg\SVGDocumentExtensions.cpp
___________________________________________________________________
Added: svn:executable
   + *