Post a microtask to load <img> elements.

Source/core/html/HTMLImageElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Library General Public License for more details.
  *
  * You should have received a copy of the GNU Library General Public License
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
 
 #include "config.h"
 #include "core/html/HTMLImageElement.h"
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
 #include "RuntimeEnabledFeatures.h"
+#include "bindings/v8/DOMWrapperWorld.h"
 #include "bindings/v8/ScriptEventListener.h"
 #include "core/dom/Attribute.h"
+#include "core/dom/Microtask.h"
 #include "core/fetch/ImageResource.h"
 #include "core/html/HTMLAnchorElement.h"
 #include "core/html/HTMLCanvasElement.h"
 #include "core/html/HTMLFormElement.h"
 #include "core/html/canvas/CanvasRenderingContext.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/html/parser/HTMLSrcsetParser.h"
 #include "core/rendering/RenderImage.h"
+#include "wtf/Vector.h"
+#include <v8.h>
 
 using namespace std;
 
+namespace {
+typedef Vector<WebCore::HTMLImageElement*> PendingUpdateQueueType;
+static PendingUpdateQueueType& PendingUpdateQueue()
+{
+    DEFINE_STATIC_LOCAL(Vector<WebCore::HTMLImageElement*>, pendingUpdateFromElementCalls, ());
+    return pendingUpdateFromElementCalls;
+}
+}
+
 namespace WebCore {
 
 using namespace HTMLNames;
 
 HTMLImageElement::HTMLImageElement(Document& document, HTMLFormElement* form)
     : HTMLElement(imgTag, document)
     , m_imageLoader(this)
     , m_compositeOperator(CompositeSourceOver)
     , m_imageDevicePixelRatio(1.0f)
     , m_formWasSetByParser(false)
+    , m_pendingUpdate(PendingUpdateNone)
 {
     ScriptWrappable::init(this);
     if (form && form->inDocument()) {
         m_form = form->createWeakPtr();
         m_formWasSetByParser = true;
         m_form->associate(*this);
         m_form->didAssociateByParser();
     }
 }
 
 PassRefPtr<HTMLImageElement> HTMLImageElement::create(Document& document)
 {
     return adoptRef(new HTMLImageElement(document));
 }
 
 PassRefPtr<HTMLImageElement> HTMLImageElement::create(Document& document, HTMLFormElement* form)
 {
     return adoptRef(new HTMLImageElement(document, form));
 }
 
 HTMLImageElement::~HTMLImageElement()
 {
     if (m_form)
         m_form->disassociate(*this);
+    cancelPendingUpdate();

[abarth-chromium, 2014/04/01 23:57:14]

This algorithm is O(N^2) when tearing down the document.  If there are N
HTMLImageElements, then each one will do O(N) work to remove itself from the
queue, which is O(N^2) total.

 }
 
 PassRefPtr<HTMLImageElement> HTMLImageElement::createForJSConstructor(Document& document, int width, int height)
 {
     RefPtr<HTMLImageElement> image = adoptRef(new HTMLImageElement(document));
     if (width)
         image->setWidth(width);
     if (height)
         image->setHeight(height);
     return image.release();
@@ skipping 70 matching lines @@
     } else if (name == srcAttr || name == srcsetAttr) {
         if (RuntimeEnabledFeatures::srcsetEnabled()) {
             ImageCandidate candidate = bestFitSourceForImageAttributes(document().devicePixelRatio(), fastGetAttribute(srcAttr), fastGetAttribute(srcsetAttr));
             m_bestFitImageURL = candidate.toAtomicString();
             float candidateScaleFactor = candidate.scaleFactor();
             if (candidateScaleFactor > 0)
                 m_imageDevicePixelRatio = 1 / candidateScaleFactor;
             if (renderer() && renderer()->isImage())
                 toRenderImage(renderer())->setImageDevicePixelRatio(m_imageDevicePixelRatio);
         }
-        m_imageLoader.updateFromElementIgnoringPreviousError();
+        enqueueUpdate(PendingUpdateIgnoreError);
     } else if (name == usemapAttr) {
         setIsLink(!value.isNull());
     } else if (name == compositeAttr) {
         // FIXME: images don't support blend modes in their compositing attribute.
         blink::WebBlendMode blendOp = blink::WebBlendModeNormal;
         if (!parseCompositeAndBlendOperator(value, m_compositeOperator, blendOp))
             m_compositeOperator = CompositeSourceOver;
     } else {
         HTMLElement::parseAttribute(name, value);
     }
@@ skipping 51 matching lines @@
 }
 
 Node::InsertionNotificationRequest HTMLImageElement::insertedInto(ContainerNode* insertionPoint)
 {
     if (!m_formWasSetByParser || insertionPoint->highestAncestor() != m_form->highestAncestor())
         resetFormOwner();
 
     // If we have been inserted from a renderer-less document,
     // our loader may have not fetched the image, so do it now.
     if (insertionPoint->inDocument() && !m_imageLoader.image())
-        m_imageLoader.updateFromElement();
+        enqueueUpdate(PendingUpdateNormal);
 
     return HTMLElement::insertedInto(insertionPoint);
 }
 
 void HTMLImageElement::removedFrom(ContainerNode* insertionPoint)
 {
     if (!m_form || m_form->highestAncestor() != highestAncestor())
         resetFormOwner();
     HTMLElement::removedFrom(insertionPoint);
 }
@@ skipping 127 matching lines @@
     if (!r)
         return 0;
 
     // FIXME: This doesn't work correctly with transforms.
     FloatPoint absPos = r->localToAbsolute();
     return absPos.y();
 }
 
 bool HTMLImageElement::complete() const
 {
-    return m_imageLoader.imageComplete();
+    return m_imageLoader.imageComplete() && !hasPendingUpdate();
 }
 
 void HTMLImageElement::didMoveToNewDocument(Document& oldDocument)
 {
     m_imageLoader.elementDidMoveToNewDocument();
     HTMLElement::didMoveToNewDocument(oldDocument);
+    if (hasPendingUpdate()) {
+        document().incrementLoadEventDelayCount();
+        oldDocument.decrementLoadEventDelayCount();
+    }
 }
 
 bool HTMLImageElement::isServerMap() const
 {
     if (!fastHasAttribute(ismapAttr))
         return false;
 
     const AtomicString& usemap = fastGetAttribute(usemapAttr);
 
     // If the usemap attribute starts with '#', it refers to a map element in the document.
@@ skipping 62 matching lines @@
     ImageResource* image = cachedImage();
     if (!image)
         return FloatSize();
     LayoutSize size;
     size = image->imageSizeForRenderer(renderer(), 1.0f); // FIXME: Not sure about this.
     if (renderer() && renderer()->isRenderImage() && image->image() && !image->image()->hasRelativeWidth())
         size.scale(toRenderImage(renderer())->imageDevicePixelRatio());
     return size;
 }
 
+void HTMLImageElement::enqueueUpdate(PendingUpdateType type)
+{
+    ASSERT(type != PendingUpdateNone);
+
+    v8::Isolate* isolate = v8::Isolate::GetCurrent();
+    bool isIsolatedWorld = false;
+    if (isolate && isolate->InContext()) {
+        if (DOMWrapperWorld::current(isolate).isIsolatedWorld())
+            isIsolatedWorld = true;
+    }

[abarth-chromium, 2014/04/01 23:57:14]

The HTMLImageElement shouldn't have any knowledge of isolated worlds...

+
+    if (m_imageLoader.shouldLoadImmediately() || isIsolatedWorld) {

[abarth-chromium, 2014/04/01 23:57:14]

It's wrong to make image loading work differently in isolated worlds.

+        if (hasPendingUpdate())
+            cancelPendingUpdate();
+        if (type == PendingUpdateNormal)
+            m_imageLoader.updateFromElement();
+        else
+            m_imageLoader.updateFromElementIgnoringPreviousError();
+        return;
+    }
+
+    if (hasPendingUpdate()) {
+        ASSERT(PendingUpdateQueue().contains(this));
+        if (m_pendingUpdate == PendingUpdateNormal && type == PendingUpdateIgnoreError)
+            m_pendingUpdate = PendingUpdateIgnoreError;
+    } else {
+        document().incrementLoadEventDelayCount();
+        PendingUpdateQueue().append(this);
+        m_pendingUpdate = type;
+    }
+    if (PendingUpdateQueue().size() == 1)
+        Microtask::enqueueMicrotask(&processUpdateFromElementQueue);
 }
+
+void HTMLImageElement::cancelPendingUpdate()
+{
+    if (hasPendingUpdate()) {
+        size_t pos = PendingUpdateQueue().find(this);
+        ASSERT(pos != kNotFound);
+        PendingUpdateQueue().remove(pos);
+        m_pendingUpdate = PendingUpdateNone;
+        document().decrementLoadEventDelayCount();
+    }
+}
+
+/* static */ void HTMLImageElement::processUpdateFromElementQueue()

[abarth-chromium, 2014/04/01 23:57:14]

We don't use /* static */ comments in Blink

+{
+    PendingUpdateQueueType pending;
+    pending.swap(PendingUpdateQueue());
+
+    // We keep this vector separately, because we can only call
+    // decrementLoadEventDelayCount after we've updated all image elements
+    // because the load event may destroy image elements.
+    Vector<RefPtr<Document> > documents;
+
+    {
+        PendingUpdateQueueType::const_iterator i, end;
+        for (i = pending.begin(), end = pending.end(); i != end; ++i) {
+            RefPtr<HTMLImageElement> current = *i;
+            if (current->m_pendingUpdate == PendingUpdateIgnoreError) {
+                current->m_pendingUpdate = PendingUpdateNone;
+                current->m_imageLoader.updateFromElementIgnoringPreviousError();
+                documents.append(&current->document());
+            } else {
+                ASSERT(current->m_pendingUpdate == PendingUpdateNormal);
+                current->m_pendingUpdate = PendingUpdateNone;
+                current->m_imageLoader.updateFromElement();
+                documents.append(&current->document());
+            }
+        }
+    }
+    Vector<RefPtr<Document> >::const_iterator i, end;
+    for (i = documents.begin(), end = documents.end(); i != end; ++i) {
+        (*i)->decrementLoadEventDelayCount();
+    }
+}
+}