Assert that loading is complete in SVGImage::hasSingleSecurityOrigin()

Source/core/svg/graphics/SVGImage.cpp

 /*
  * Copyright (C) 2006 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 65 matching lines @@
 
     return page->chrome().client().isSVGImageChromeClient();
 }
 
 bool SVGImage::hasSingleSecurityOrigin() const
 {
     if (!m_page)
         return true;
 
     Frame* frame = m_page->mainFrame();
+
+    RELEASE_ASSERT(!frame->loader()->activeDocumentLoader()->isLoading());

[abarth-chromium, 2013/08/21 17:07:31]

If you want to do things this way, the best check is probably:

RELEASE_ASSERT(frame->document()->loadEventFinished());

That will become true once we're done firing the load event for the given
document.

+
     SVGSVGElement* rootElement = toSVGDocument(frame->document())->rootElement();
     if (!rootElement)
         return true;
 
     // Don't allow foreignObject elements or images that are not known to be
     // single-origin since these can leak cross-origin information.
     ComposedShadowTreeWalker walker(rootElement);
     while (Node* node = walker.get()) {
         if (node->hasTagName(SVGNames::foreignObjectTag))
             return false;
@@ skipping 314 matching lines @@
     return m_page;
 }
 
 String SVGImage::filenameExtension() const
 {
     return "svg";
 }
 
 }