<image>'s src URL is resolved incorrectly when <base> element dynamically added

third_party/WebKit/Source/core/loader/ImageLoader.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 97 matching lines @@
     static void dispatchPendingErrorEvents();
 
     bool getImageAnimationPolicy(ImageAnimationPolicy&) final;
 protected:
     void imageNotifyFinished(ImageResource*) override;
 
 private:
     class Task;
 
     // Called from the task or from updateFromElement to initiate the load.
-    void doUpdateFromElement(BypassMainWorldBehavior, UpdateFromElementBehavior, ReferrerPolicy = ReferrerPolicyDefault);
+    void doUpdateFromElement(BypassMainWorldBehavior, UpdateFromElementBehavior, const KURL&, ReferrerPolicy = ReferrerPolicyDefault);
 
     virtual void dispatchLoadEvent() = 0;
     virtual void noImageResourceToLoad() { }
 
     void updatedHasPendingEvent();
 
     void dispatchPendingLoadEvent();
     void dispatchPendingErrorEvent();
 
     LayoutImageResource* layoutImageResource();
@@ skipping 35 matching lines @@
     bool m_hasPendingErrorEvent : 1;
     bool m_imageComplete : 1;
     bool m_loadingImageDocument : 1;
     bool m_elementIsProtected : 1;
     bool m_suppressErrorEvents : 1;
 };
 
 } // namespace blink
 
 #endif