Prevent synchronous image change notifications during paint

third_party/WebKit/Source/core/layout/LayoutObject.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 3216 matching lines @@
 {
     const LayoutObject* layoutObject = this;
     while (!layoutObject->node())
         layoutObject = layoutObject->parent();
     return layoutObject->node()->isInert();
 }
 
 void LayoutObject::imageChanged(ImageResource* image, const IntRect* rect)
 {
     ASSERT(m_node);
+
+    // Image change notifications should not be received during paint because
+    // the resulting invalidations will be cleared following paint. This can also
+    // lead to modifying the tree out from under paint(), see: crbug.com/616700.
+    DCHECK(document().lifecycle().state() != DocumentLifecycle::LifecycleState::InPaint);
+
     imageChanged(static_cast<WrappedImagePtr>(image), rect);
 }
 
 Element* LayoutObject::offsetParent() const
 {
     if (isDocumentElement() || isBody())
         return nullptr;
 
     if (isOutOfFlowPositioned() && style()->position() == FixedPosition)
         return nullptr;
@@ skipping 454 matching lines @@
         const blink::LayoutObject* root = object1;
         while (root->parent())
             root = root->parent();
         root->showLayoutTreeAndMark(object1, "*", object2, "-", 0);
     } else {
         fprintf(stderr, "Cannot showLayoutTree. Root is (nil)\n");
     }
 }
 
 #endif