[svg] in img element doesn't render correctly when height is changed dynamically.

Source/core/rendering/svg/RenderSVGRoot.h

 /*
  * Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2007 Rob Buis <buis@kde.org>
  * Copyright (C) 2009 Google, Inc.  All rights reserved.
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 35 matching lines @@
     RenderObject* lastChild() const { ASSERT(children() == virtualChildren()); return children()->lastChild(); }
 
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
 
     bool isLayoutSizeChanged() const { return m_isLayoutSizeChanged; }
     virtual void setNeedsBoundariesUpdate() OVERRIDE { m_needsBoundariesOrTransformUpdate = true; }
     virtual void setNeedsTransformUpdate() OVERRIDE { m_needsBoundariesOrTransformUpdate = true; }
 
     IntSize containerSize() const { return m_containerSize; }
-    void setContainerSize(const IntSize& containerSize) { m_containerSize = containerSize; }
+    void setContainerSize(const IntSize& containerSize)
+    {
+        if (m_containerSize != containerSize)
+            setNeedsLayout();

[f(malita), 2014/03/24 16:23:12]

This can be hit during paint(), which would normally be a big no-no.

But SVGImage::draw() performs a view layout before painting, so as long as
setContainerSize() happens before that and doesn't bubble outside the view scope
(which I don't think it does) it should be fine. Maybe you can add a comment
explaining why this is ok.

Come to think of it, we should probably ASSERT(!view->needsLayout()) in
SVGImage::draw(), after view->paint(...).

+        m_containerSize = containerSize;
+    }
 
     virtual bool hasRelativeIntrinsicLogicalWidth() const OVERRIDE;
     virtual bool hasRelativeLogicalHeight() const OVERRIDE;
     virtual bool visibleForTouchAction() const OVERRIDE { return true; }
 
     // localToBorderBoxTransform maps local SVG viewport coordinates to local CSS box coordinates.
     const AffineTransform& localToBorderBoxTransform() const { return m_localToBorderBoxTransform; }
 
 private:
     virtual RenderObjectChildList* virtualChildren() OVERRIDE { return children(); }
@@ skipping 48 matching lines @@
     AffineTransform m_localToBorderBoxTransform;
     bool m_isLayoutSizeChanged : 1;
     bool m_needsBoundariesOrTransformUpdate : 1;
 };
 
 DEFINE_RENDER_OBJECT_TYPE_CASTS(RenderSVGRoot, isSVGRoot());
 
 } // namespace WebCore
 
 #endif // RenderSVGRoot_h