Make multipart image documents work again.

Source/core/html/ImageDocument.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 118 matching lines @@
 
     LocalFrame* frame = document()->frame();
     Settings* settings = frame->settings();
     if (!frame->loader().client()->allowImage(!settings || settings->imagesEnabled(), document()->url()))
         return;
 
     if (document()->cachedImage()) {
         RELEASE_ASSERT(length <= std::numeric_limits<unsigned>::max());
         document()->cachedImage()->appendData(data, length);
     }
+
+    if (!document())

[Nate Chapin, 2015/05/27 20:45:24]

Here and in finish(), if createDocumentStructure() is called inside
cachedImage() and the content is multipart, we will finish parsing synchronously
and document() will be null by the time we reach here.

+        return;
+
     // Make sure the image layoutObject gets created because we need the layoutObject
     // to read the aspect ratio. See crbug.com/320244
     document()->updateLayoutTreeIfNeeded();
     document()->imageUpdated();
 }
 
 void ImageDocumentParser::finish()
 {
     if (!isStopped() && document()->imageElement() && document()->cachedImage()) {
         ImageResource* cachedImage = document()->cachedImage();
         cachedImage->finish();
         cachedImage->setResponse(document()->frame()->loader().documentLoader()->response());
 
         // Report the natural image size in the page title, regardless of zoom level.
         // At a zoom level of 1 the image is guaranteed to have an integer size.
         IntSize size = flooredIntSize(cachedImage->imageSizeForLayoutObject(document()->imageElement()->layoutObject(), 1.0f));
         if (size.width()) {
             // Compute the title, we use the decoded filename of the resource, falling
             // back on the (decoded) hostname if there is no path.
             String fileName = decodeURLEscapeSequences(document()->url().lastPathComponent());
             if (fileName.isEmpty())
                 fileName = document()->url().host();
             document()->setTitle(imageTitle(fileName, size));
         }
 
         document()->imageUpdated();
     }
 
-    document()->finishedParsing();
+    if (document())
+        document()->finishedParsing();
 }
 
 // --------
 
 ImageDocument::ImageDocument(const DocumentInit& initializer)
     : HTMLDocument(initializer, ImageDocumentClass)
     , m_imageElement(nullptr)
     , m_imageSizeIsKnown(false)
     , m_didShrinkImage(false)
     , m_shouldShrinkImage(shouldShrinkToFit())
     , m_shrinkToFitMode(frame()->settings()->viewportEnabled() ? Viewport : Desktop)
 {
     setCompatibilityMode(QuirksMode);
     lockCompatibilityMode();
 }
 
 PassRefPtrWillBeRawPtr<DocumentParser> ImageDocument::createParser()
 {
     return ImageDocumentParser::create(this);
 }
 
-void ImageDocument::createDocumentStructure()
+void ImageDocument::createDocumentStructure(bool loadingMultipartContent)
 {
     RefPtrWillBeRawPtr<HTMLHtmlElement> rootElement = HTMLHtmlElement::create(*this);
     appendChild(rootElement);
     rootElement->insertedByParser();
 
     if (frame())
         frame()->loader().dispatchDocumentElementAvailable();
+    // Normally, ImageDocument creates an HTMLImageElement that doesn't actually load
+    // anything, and the ImageDocument routes the main resource data into the HTMLImageElement's
+    // ImageResource. However, the main resource pipeline doesn't know how to handle multipart content.
+    // For multipart content, we instead stop streaming data through the main resource and re-request
+    // the data directly.
+    if (loadingMultipartContent)
+        loader()->stopLoading();
 
     RefPtrWillBeRawPtr<HTMLHeadElement> head = HTMLHeadElement::create(*this);
     RefPtrWillBeRawPtr<HTMLMetaElement> meta = HTMLMetaElement::create(*this);
     meta->setAttribute(nameAttr, "viewport");
     meta->setAttribute(contentAttr, "width=device-width, minimum-scale=0.1");
     head->appendChild(meta);
 
     RefPtrWillBeRawPtr<HTMLBodyElement> body = HTMLBodyElement::create(*this);
     body->setAttribute(styleAttr, "margin: 0px;");
 
     m_imageElement = HTMLImageElement::create(*this);
     m_imageElement->setAttribute(styleAttr, "-webkit-user-select: none");
-    m_imageElement->setLoadingImageDocument();
+    // If the image is multipart, we neglect to mention to the HTMLImageElement that it's in an
+    // ImageDocument, so that it requests the image normally.
+    if (!loadingMultipartContent)
+        m_imageElement->setLoadingImageDocument();
     m_imageElement->setSrc(url().string());
     body->appendChild(m_imageElement.get());
 
     if (shouldShrinkToFit()) {
         // Add event listeners
         RefPtr<EventListener> listener = ImageEventListener::create(this);
         if (LocalDOMWindow* domWindow = this->domWindow())
             domWindow->addEventListener("resize", listener, false);
         if (m_shrinkToFitMode == Desktop)
             m_imageElement->addEventListener("click", listener.release(), false);
     }
 
     rootElement->appendChild(head);
     rootElement->appendChild(body);
+    if (loadingMultipartContent)
+        finishedParsing();

[Nate Chapin, 2015/05/27 20:45:24]

The stopLoading() call above leaves us in a half-complete state where
finishedParsing() will never get called. Call finishedParsing here to ensure
mjpeg ImageDocuments in iframes work.

 }
 
 float ImageDocument::scale() const
 {
     if (!m_imageElement || m_imageElement->document() != this)
         return 1.0f;
 
     FrameView* view = frame()->view();
     if (!view)
         return 1;
@@ skipping 146 matching lines @@
         // If the image isn't resized but needs to be, then resize it.
         if (!fitsInWindow) {
             resizeImageToFit(type);
             m_didShrinkImage = true;
         }
     }
 }
 
 ImageResource* ImageDocument::cachedImage()
 {
+    bool loadingMultipartContent = loader() && loader()->loadingMultipartContent();
     if (!m_imageElement)
-        createDocumentStructure();
+        createDocumentStructure(loadingMultipartContent);
 
-    return m_imageElement->cachedImage();
+    return loadingMultipartContent ? nullptr : m_imageElement->cachedImage();

[Nate Chapin, 2015/05/27 20:45:25]

Since multipart images will load their own content, don't let the DocumentParser
add data to it.

 }
 
 bool ImageDocument::shouldShrinkToFit() const
 {
     return frame()->isMainFrame();
 }
 
 #if !ENABLE(OILPAN)
 void ImageDocument::dispose()
 {
@@ skipping 21 matching lines @@
 }
 
 bool ImageEventListener::operator==(const EventListener& listener)
 {
     if (const ImageEventListener* imageEventListener = ImageEventListener::cast(&listener))
         return m_doc == imageEventListener->m_doc;
     return false;
 }
 
 }