<image>'s src URL is resolved incorrectly when <base> element dynamically added

third_party/WebKit/Source/core/loader/ImageLoader.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 89 matching lines @@
         v8::Isolate* isolate = V8PerIsolateData::mainThreadIsolate();
         v8::HandleScope scope(isolate);
         // If we're invoked from C++ without a V8 context on the stack, we should
         // run the microtask in the context of the element's document's main world.
         if (ScriptState::hasCurrentScriptState(isolate)) {
             m_scriptState = ScriptState::current(isolate);
         } else {
             m_scriptState = ScriptState::forMainWorld(loader->element()->document().frame());
             ASSERT(m_scriptState);
         }
+        AtomicString imageSourceURL = loader->element()->imageSourceURL();
+        m_requestURL = loader->imageSourceToKURL(imageSourceURL);
     }
 
     void run()
     {
         if (!m_loader)
             return;
         ExecutionContext& context = m_loader->element()->document();
         InspectorInstrumentation::AsyncTask asyncTask(&context, this);
         if (m_scriptState->contextIsValid()) {
             ScriptState::Scope scope(m_scriptState.get());
-            m_loader->doUpdateFromElement(m_shouldBypassMainWorldCSP, m_updateBehavior, m_referrerPolicy);
+            m_loader->doUpdateFromElement(m_shouldBypassMainWorldCSP, m_updateBehavior, m_requestURL, m_referrerPolicy);
         } else {
-            m_loader->doUpdateFromElement(m_shouldBypassMainWorldCSP, m_updateBehavior, m_referrerPolicy);
+            m_loader->doUpdateFromElement(m_shouldBypassMainWorldCSP, m_updateBehavior, m_requestURL, m_referrerPolicy);
         }
     }
 
     void clearLoader()
     {
         m_loader = nullptr;
         m_scriptState.clear();
     }
 
     WeakPtr<Task> createWeakPtr()
     {
         return m_weakFactory.createWeakPtr();
     }
 
 private:
     WeakPersistent<ImageLoader> m_loader;
     BypassMainWorldBehavior m_shouldBypassMainWorldCSP;
     UpdateFromElementBehavior m_updateBehavior;
     RefPtr<ScriptState> m_scriptState;
     WeakPtrFactory<Task> m_weakFactory;
     ReferrerPolicy m_referrerPolicy;
+    KURL m_requestURL;
 };
 
 ImageLoader::ImageLoader(Element* element)
     : m_element(element)
     , m_derefElementTimer(this, &ImageLoader::timerFired)
     , m_hasPendingLoadEvent(false)
     , m_hasPendingErrorEvent(false)
     , m_imageComplete(true)
     , m_loadingImageDocument(false)
     , m_elementIsProtected(false)
@@ skipping 90 matching lines @@
 }
 
 inline void ImageLoader::enqueueImageLoadingMicroTask(UpdateFromElementBehavior updateBehavior, ReferrerPolicy referrerPolicy)
 {
     std::unique_ptr<Task> task = Task::create(this, updateBehavior, referrerPolicy);
     m_pendingTask = task->createWeakPtr();
     Microtask::enqueueMicrotask(WTF::bind(&Task::run, passed(std::move(task))));
     m_loadDelayCounter = IncrementLoadEventDelayCount::create(m_element->document());
 }
 
-void ImageLoader::doUpdateFromElement(BypassMainWorldBehavior bypassBehavior, UpdateFromElementBehavior updateBehavior, ReferrerPolicy referrerPolicy)
+void ImageLoader::doUpdateFromElement(BypassMainWorldBehavior bypassBehavior, UpdateFromElementBehavior updateBehavior, const KURL& url, ReferrerPolicy referrerPolicy)
 {
     // FIXME: According to
     // http://www.whatwg.org/specs/web-apps/current-work/multipage/embedded-content.html#the-img-element:the-img-element-55
     // When "update image" is called due to environment changes and the load fails, onerror should not be called.
     // That is currently not the case.
     //
     // We don't need to call clearLoader here: Either we were called from the
     // task, or our caller updateFromElement cleared the task's loader (and set
     // m_pendingTask to null).
     m_pendingTask.clear();
     // Make sure to only decrement the count when we exit this function
     std::unique_ptr<IncrementLoadEventDelayCount> loadDelayCounter;
     loadDelayCounter.swap(m_loadDelayCounter);
 
     Document& document = m_element->document();
     if (!document.isActive())
         return;
 
     AtomicString imageSourceURL = m_element->imageSourceURL();

[Yoav Weiss, 2016/07/04 07:18:14]

Can you explain why moving the imageSourceToKURL call to the time the task is
created is helpful? What is the value of imageSourceURL here and how does it
differ from url?

If url is the correct one here, we should probably deduce imageSourceURL from
it, rather than grabbing the value from m_element

-    KURL url = imageSourceToKURL(imageSourceURL);
     ImageResource* newImage = nullptr;
     if (!url.isNull()) {
         // Unlike raw <img>, we block mixed content inside of <picture> or <img srcset>.
         ResourceLoaderOptions resourceLoaderOptions = ResourceFetcher::defaultResourceOptions();
         ResourceRequest resourceRequest(url);
         if (updateBehavior == UpdateForcedReload) {
             resourceRequest.setCachePolicy(WebCachePolicy::BypassingCache);
             resourceRequest.setLoFiState(WebURLRequest::LoFiOff);
         }
 
@@ skipping 86 matching lines @@
 
     // If we have a pending task, we have to clear it -- either we're
     // now loading immediately, or we need to reset the task's state.
     if (m_pendingTask) {
         m_pendingTask->clearLoader();
         m_pendingTask.clear();
     }
 
     KURL url = imageSourceToKURL(imageSourceURL);
     if (shouldLoadImmediately(url)) {
-        doUpdateFromElement(DoNotBypassMainWorldCSP, updateBehavior, referrerPolicy);
+        doUpdateFromElement(DoNotBypassMainWorldCSP, updateBehavior, url, referrerPolicy);
         return;
     }
     // Allow the idiom "img.src=''; img.src='.." to clear down the image before
     // an asynchronous load completes.
     if (imageSourceURL.isEmpty()) {
         ImageResource* image = m_image.get();
         if (image) {
             image->removeObserver(this);
         }
         m_image = nullptr;
@@ skipping 211 matching lines @@
 
 void ImageLoader::elementDidMoveToNewDocument()
 {
     if (m_loadDelayCounter)
         m_loadDelayCounter->documentChanged(m_element->document());
     clearFailedLoadURL();
     setImage(0);
 }
 
 } // namespace blink