Make multipart image documents work again.

Source/core/html/ImageDocument.cpp

Index: Source/core/html/ImageDocument.cpp
diff --git a/Source/core/html/ImageDocument.cpp b/Source/core/html/ImageDocument.cpp
index 8fe7336858781632fcda90fb1a3d172791207de5..2413c2da116165f056c5e870d7bf49e334865067 100644
--- a/Source/core/html/ImageDocument.cpp
+++ b/Source/core/html/ImageDocument.cpp
@@ -136,6 +136,10 @@ void ImageDocumentParser::appendBytes(const char* data, size_t length)
         RELEASE_ASSERT(length <= std::numeric_limits<unsigned>::max());
         document()->cachedImage()->appendData(data, length);
     }
+
+    if (!document())

[Nate Chapin, 2015/05/27 20:45:24]

Here and in finish(), if createDocumentStructure() is called inside
cachedImage() and the content is multipart, we will finish parsing synchronously
and document() will be null by the time we reach here.

+        return;
+
     // Make sure the image layoutObject gets created because we need the layoutObject
     // to read the aspect ratio. See crbug.com/320244
     document()->updateLayoutTreeIfNeeded();
@@ -164,7 +168,8 @@ void ImageDocumentParser::finish()
         document()->imageUpdated();
     }
 
-    document()->finishedParsing();
+    if (document())
+        document()->finishedParsing();
 }
 
 // --------
@@ -186,7 +191,7 @@ PassRefPtrWillBeRawPtr<DocumentParser> ImageDocument::createParser()
     return ImageDocumentParser::create(this);
 }
 
-void ImageDocument::createDocumentStructure()
+void ImageDocument::createDocumentStructure(bool loadingMultipartContent)
 {
     RefPtrWillBeRawPtr<HTMLHtmlElement> rootElement = HTMLHtmlElement::create(*this);
     appendChild(rootElement);
@@ -194,6 +199,13 @@ void ImageDocument::createDocumentStructure()
 
     if (frame())
         frame()->loader().dispatchDocumentElementAvailable();
+    // Normally, ImageDocument creates an HTMLImageElement that doesn't actually load
+    // anything, and the ImageDocument routes the main resource data into the HTMLImageElement's
+    // ImageResource. However, the main resource pipeline doesn't know how to handle multipart content.
+    // For multipart content, we instead stop streaming data through the main resource and re-request
+    // the data directly.
+    if (loadingMultipartContent)
+        loader()->stopLoading();
 
     RefPtrWillBeRawPtr<HTMLHeadElement> head = HTMLHeadElement::create(*this);
     RefPtrWillBeRawPtr<HTMLMetaElement> meta = HTMLMetaElement::create(*this);
@@ -206,7 +218,10 @@ void ImageDocument::createDocumentStructure()
 
     m_imageElement = HTMLImageElement::create(*this);
     m_imageElement->setAttribute(styleAttr, "-webkit-user-select: none");
-    m_imageElement->setLoadingImageDocument();
+    // If the image is multipart, we neglect to mention to the HTMLImageElement that it's in an
+    // ImageDocument, so that it requests the image normally.
+    if (!loadingMultipartContent)
+        m_imageElement->setLoadingImageDocument();
     m_imageElement->setSrc(url().string());
     body->appendChild(m_imageElement.get());
 
@@ -221,6 +236,8 @@ void ImageDocument::createDocumentStructure()
 
     rootElement->appendChild(head);
     rootElement->appendChild(body);
+    if (loadingMultipartContent)
+        finishedParsing();

[Nate Chapin, 2015/05/27 20:45:24]

The stopLoading() call above leaves us in a half-complete state where
finishedParsing() will never get called. Call finishedParsing here to ensure
mjpeg ImageDocuments in iframes work.

 }
 
 float ImageDocument::scale() const
@@ -387,10 +404,11 @@ void ImageDocument::windowSizeChanged(ScaleType type)
 
 ImageResource* ImageDocument::cachedImage()
 {
+    bool loadingMultipartContent = loader() && loader()->loadingMultipartContent();
     if (!m_imageElement)
-        createDocumentStructure();
+        createDocumentStructure(loadingMultipartContent);
 
-    return m_imageElement->cachedImage();
+    return loadingMultipartContent ? nullptr : m_imageElement->cachedImage();

[Nate Chapin, 2015/05/27 20:45:25]

Since multipart images will load their own content, don't let the DocumentParser
add data to it.

 }
 
 bool ImageDocument::shouldShrinkToFit() const