[CSS Shapes] Dynamically created element with image valued shape-outside doesn't update

Source/core/rendering/RenderBox.cpp

Index: Source/core/rendering/RenderBox.cpp
diff --git a/Source/core/rendering/RenderBox.cpp b/Source/core/rendering/RenderBox.cpp
index abf97e337275b9b818e57e6032ed1489f7674130..e9e5c9eb64349825f23557f9b0266f4a4fd309e8 100644
--- a/Source/core/rendering/RenderBox.cpp
+++ b/Source/core/rendering/RenderBox.cpp
@@ -1630,11 +1630,16 @@ void RenderBox::imageChanged(WrappedImagePtr image, const IntRect*)
         return;
     }
 
+    ShapeValue* shapeOutsideValue = style()->shapeOutside();
+    if (!(frameView() && frameView()->isInPerformLayout()) && isFloating() && shapeOutsideValue && shapeOutsideValue->image() && shapeOutsideValue->image()->data() == image) {

[eseidel, 2014/02/04 17:40:48]

We shouldn't be talking to renderers who cannot reach a frameview, so I would
turn the frameView() check into an ASSERT or remove it.  If it turns out it's
needed, we should file a bug to remove it.

Are you sure the isInLayout check is correct?  I wouldn't expect loads to
complete at arbitrary times during layout, so I would not expect images to
change, but maybe this is from an SVGImage case?

+        ShapeOutsideInfo::ensureInfo(this)->dirtyShapeSize();
+        markShapeOutsideDependentsForLayout();
+    }
+
     bool didFullRepaint = repaintLayerRectsForImage(image, style()->backgroundLayers(), true);
     if (!didFullRepaint)
         repaintLayerRectsForImage(image, style()->maskLayers(), false);
 
-
     if (hasLayer() && layer()->hasCompositedMask() && layersUseImage(image, style()->maskLayers()))
         layer()->contentChanged(MaskImageChanged);
 }