Don't use SVG resource documents with an unrecognized MIME-type

third_party/WebKit/Source/core/svg/SVGUseElement.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
  * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
  * Copyright (C) 2011 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  * Copyright (C) 2012 University of Szeged
  * Copyright (C) 2012 Renata Hodovan <reni@webkit.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 128 matching lines @@
 
 TreeScope* SVGUseElement::referencedScope() const
 {
     if (isStructurallyExternal())
         return externalDocument();
     return &treeScope();
 }
 
 Document* SVGUseElement::externalDocument() const
 {
-    if (m_resource && m_resource->isLoaded()) {
-        // Gracefully handle error condition.
-        if (m_resource->errorOccurred())
-            return nullptr;
-        ASSERT(m_resource->document());
-        return m_resource->document();
-    }
-    return nullptr;
+    // Gracefully handle error condition.
+    if (!resourceIsValid())
+        return nullptr;
+    ASSERT(m_resource->document());
+    return m_resource->document();
 }
 
 void transferUseWidthAndHeightIfNeeded(const SVGUseElement& use, SVGElement* shadowElement, const SVGElement& originalElement)
 {
     DEFINE_STATIC_LOCAL(const AtomicString, hundredPercentString, ("100%", AtomicString::ConstructFromLiteral));
     ASSERT(shadowElement);
     if (isSVGSymbolElement(*shadowElement)) {
         // Spec (<use> on <symbol>): This generated 'svg' will always have explicit values for attributes width and height.
         // If attributes width and/or height are provided on the 'use' element, then these attributes
         // will be transferred to the generated 'svg'. If attributes width and/or height are not specified,
@@ skipping 615 matching lines @@
 
 void SVGUseElement::dispatchPendingEvent(SVGUseEventSender* eventSender)
 {
     ASSERT_UNUSED(eventSender, eventSender == &svgUseLoadEventSender());
     ASSERT(isStructurallyExternal() && m_haveFiredLoadEvent);
     dispatchEvent(Event::create(EventTypeNames::load));
 }
 
 void SVGUseElement::notifyFinished(Resource* resource)
 {
+    ASSERT(m_resource == resource);
     if (!inDocument())
         return;
 
     invalidateShadowTree();
-    if (resource->errorOccurred()) {
+    if (!resourceIsValid()) {
         dispatchEvent(Event::create(EventTypeNames::error));
     } else if (!resource->wasCanceled()) {
         if (m_haveFiredLoadEvent)
             return;
         if (!isStructurallyExternal())
             return;
         ASSERT(!m_haveFiredLoadEvent);
         m_haveFiredLoadEvent = true;
         svgUseLoadEventSender().dispatchEventSoon(this);
     }
 }
 
 bool SVGUseElement::resourceIsStillLoading() const
 {
     return m_resource && m_resource->isLoading();
 }
 
+bool SVGUseElement::resourceIsValid() const
+{
+    return m_resource
+        && m_resource->isLoaded()
+        && !m_resource->errorOccurred()
+        && m_resource->document();
+}
+
 bool SVGUseElement::instanceTreeIsLoading(const SVGElement* targetInstance)
 {
     for (const SVGElement* element = targetInstance; element; element = Traversal<SVGElement>::next(*element, targetInstance)) {
         if (isSVGUseElement(*element) && toSVGUseElement(*element).resourceIsStillLoading())
             return true;
     }
     return false;
 }
 
 void SVGUseElement::setDocumentResource(PassRefPtrWillBeRawPtr<DocumentResource> resource)
 {
     if (m_resource == resource)
         return;
 
     if (m_resource)
         m_resource->removeClient(this);
 
     m_resource = resource;
     if (m_resource)
         m_resource->addClient(this);
 }
 
 } // namespace blink