Consider Layout tree cycles when resolving the <pattern> content element

Source/core/layout/svg/LayoutSVGResourcePattern.cpp

 /*
  * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  * Copyright 2014 The Chromium Authors. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Library General Public License for more details.
  *
  * You should have received a copy of the GNU Library General Public License
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
 
 #include "config.h"
 #include "core/layout/svg/LayoutSVGResourcePattern.h"
 
-#include "core/dom/ElementTraversal.h"
 #include "core/layout/svg/SVGLayoutSupport.h"
+#include "core/layout/svg/SVGResources.h"
 #include "core/paint/SVGPaintContext.h"
 #include "core/paint/TransformRecorder.h"
 #include "core/svg/SVGFitToViewBox.h"
 #include "core/svg/SVGPatternElement.h"
 #include "platform/graphics/GraphicsContext.h"
 #include "platform/graphics/paint/DisplayItemList.h"
 #include "platform/graphics/paint/SkPictureBuilder.h"
 #include "third_party/skia/include/core/SkPicture.h"
 
 namespace blink {
@@ skipping 111 matching lines @@
 
     PatternData* patternData = patternForLayoutObject(object);
     if (!patternData || !patternData->pattern)
         return SVGPaintServer::invalid();
 
     patternData->pattern->setPatternSpaceTransform(patternData->transform);
 
     return SVGPaintServer(patternData->pattern);
 }
 
+const LayoutSVGResourceContainer* LayoutSVGResourcePattern::resolveContentElement() const
+{
+    ASSERT(attributes().patternContentElement());
+    LayoutSVGResourceContainer* expectedLayoutObject =
+        toLayoutSVGResourceContainer(attributes().patternContentElement()->layoutObject());
+    // No content inheritance - avoid walking the inheritance chain.
+    if (this == expectedLayoutObject)
+        return this;
+    // Walk the inheritance chain on the LayoutObject-side. If we reach the
+    // expected LayoutObject, all is fine. If we don't, there's a cycle that
+    // the cycle resolver did break, and the resource will be content-less.
+    const LayoutSVGResourceContainer* contentLayoutObject = this;
+    while (SVGResources* resources = SVGResourcesCache::cachedResourcesForLayoutObject(contentLayoutObject)) {
+        LayoutSVGResourceContainer* linkedResource = resources->linkedResource();
+        if (!linkedResource)
+            break;
+        if (linkedResource == expectedLayoutObject)
+            return expectedLayoutObject;
+        contentLayoutObject = linkedResource;
+    }
+    // There was a cycle, just use this resource as the "content resource" even
+    // though it will be empty (have no children).
+    return this;
+}
+
 PassRefPtr<const SkPicture> LayoutSVGResourcePattern::asPicture(const FloatRect& tileBounds,
     const AffineTransform& tileTransform) const
 {
     ASSERT(!m_shouldCollectPatternAttributes);
 
     AffineTransform contentTransform;
     if (attributes().patternContentUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
         contentTransform = tileTransform;
 
     FloatRect bounds(FloatPoint(), tileBounds.size());
     SkPictureBuilder pictureBuilder(bounds);
 
-    ASSERT(attributes().patternContentElement());
-    LayoutSVGResourceContainer* patternLayoutObject =
-        toLayoutSVGResourceContainer(attributes().patternContentElement()->layoutObject());
-    ASSERT(patternLayoutObject);
-    ASSERT(!patternLayoutObject->needsLayout());
+    const LayoutSVGResourceContainer* patternLayoutObject = resolveContentElement();
+    ASSERT(patternLayoutObject && !patternLayoutObject->needsLayout());
 
     SubtreeContentTransformScope contentTransformScope(contentTransform);
 
     {
         TransformRecorder transformRecorder(pictureBuilder.context(), *patternLayoutObject, tileTransform);
         for (LayoutObject* child = patternLayoutObject->firstChild(); child; child = child->nextSibling())
             SVGPaintContext::paintSubtree(&pictureBuilder.context(), child);
     }
 
     return pictureBuilder.endRecording();
 }
 
 }