Collapse images disallowed by the Safe Browsing Subresource Filter.

third_party/WebKit/Source/core/html/HTMLImageElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2010 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 75 matching lines @@
 };
 
 HTMLImageElement::HTMLImageElement(Document& document,
                                    HTMLFormElement* form,
                                    bool createdByParser)
     : HTMLElement(imgTag, document),
       ActiveScriptWrappable(this),
       m_imageLoader(HTMLImageLoader::create(this)),
       m_imageDevicePixelRatio(1.0f),
       m_source(nullptr),
+      m_layoutDisposition(LayoutDisposition::PrimaryContent),
       m_formWasSetByParser(false),
       m_elementCreatedByParser(createdByParser),
-      m_useFallbackContent(false),
       m_isFallbackImage(false),
       m_referrerPolicy(ReferrerPolicyDefault) {
   setHasCustomStyleCallbacks();
   if (form && form->isConnected()) {
     m_form = form;
     m_formWasSetByParser = true;
     m_form->associate(*this);
     m_form->didAssociateByParser();
   }
 }
@@ skipping 223 matching lines @@
         document().devicePixelRatio(), sourceSize(*source),
         source->fastGetAttribute(srcsetAttr), &document());
     if (candidate.isEmpty())
       continue;
     m_source = source;
     return candidate;
   }
   return ImageCandidate();
 }
 
+bool HTMLImageElement::layoutObjectIsNeeded(const ComputedStyle& style) {
+  return m_layoutDisposition != LayoutDisposition::Collapsed &&
+         HTMLElement::layoutObjectIsNeeded(style);
+}
+
 LayoutObject* HTMLImageElement::createLayoutObject(const ComputedStyle& style) {
   const ContentData* contentData = style.contentData();
   if (contentData && contentData->isImage()) {
     const StyleImage* contentImage = toImageContentData(contentData)->image();
     bool errorOccurred = contentImage && contentImage->cachedImage() &&
                          contentImage->cachedImage()->errorOccurred();
     if (!errorOccurred)
       return LayoutObject::createObject(this, style);
   }
 
-  if (m_useFallbackContent)
-    return new LayoutBlockFlow(this);
-
-  LayoutImage* image = new LayoutImage(this);
-  image->setImageResource(LayoutImageResource::create());
-  image->setImageDevicePixelRatio(m_imageDevicePixelRatio);
-  return image;
+  switch (m_layoutDisposition) {

[dominicc (has gone to gerrit), 2016/12/07 01:51:42]

Sadness, it seems the compiler doesn't work out that these cases are exhaustive.
I guess we need to add default and have LayoutDisposition::Collapsed fall
through to that.

[engedy, 2016/12/07 09:37:41]

Done.

+    case LayoutDisposition::FallbackContent:
+      return new LayoutBlockFlow(this);
+    case LayoutDisposition::PrimaryContent: {
+      LayoutImage* image = new LayoutImage(this);
+      image->setImageResource(LayoutImageResource::create());
+      image->setImageDevicePixelRatio(m_imageDevicePixelRatio);
+      return image;
+    }
+    case LayoutDisposition::Collapsed:
+      NOTREACHED();
+      return nullptr;
+  }
 }
 
 void HTMLImageElement::attachLayoutTree(const AttachContext& context) {
   HTMLElement::attachLayoutTree(context);
 
   if (layoutObject() && layoutObject()->isImage()) {
     LayoutImage* layoutImage = toLayoutImage(layoutObject());
     LayoutImageResource* layoutImageResource = layoutImage->imageResource();
     if (m_isFallbackImage) {
       float deviceScaleFactor = blink::deviceScaleFactor(layoutImage->frame());
@@ skipping 394 matching lines @@
     setBestFitURLAndDPRFromImageCandidate(candidate);
     foundURL = true;
   }
 
   if (!foundURL) {
     candidate = bestFitSourceForImageAttributes(
         document().devicePixelRatio(), sourceSize(*this),
         fastGetAttribute(srcAttr), fastGetAttribute(srcsetAttr), &document());
     setBestFitURLAndDPRFromImageCandidate(candidate);
   }
+
   imageLoader().updateFromElement(behavior, m_referrerPolicy);
 
   // Images such as data: uri's can return immediately and may already have
   // errored out.
   bool imageHasLoaded = imageLoader().image() &&
                         !imageLoader().image()->isLoading() &&
                         !imageLoader().image()->errorOccurred();
   bool imageStillLoading =
       !imageHasLoaded && imageLoader().hasPendingActivity() &&
       !imageLoader().hasPendingError() && !imageSourceURL().isEmpty();
@@ skipping 11 matching lines @@
   // sufficient, because a deferred image does have pending activity, does not
   // have a pending error, and does have a source URL, so if imageHasLoaded
   // was correct, imageStillLoading would become wrong.
   //
   // Instead of dealing with that, there's a separate check that the
   // ImageResource has non-null image data associated with it, which isn't
   // folded into imageHasLoaded above.
   if ((imageHasLoaded && imageHasImage) || imageStillLoading || imageIsDocument)
     ensurePrimaryContent();
   else
-    ensureFallbackContent();
+    ensureCollapsedOrFallbackContent();
 }
 
 const KURL& HTMLImageElement::sourceURL() const {
   return cachedImage()->response().url();
 }
 
 void HTMLImageElement::didAddUserAgentShadowRoot(ShadowRoot&) {
   HTMLImageFallbackHelper::createAltTextShadowTree(*this);
 }
 
 void HTMLImageElement::ensureFallbackForGeneratedContent() {
-  setUseFallbackContent();
-  reattachFallbackContent();
+  // FIXME: The special casing for generated content in createLayoutObject

[dominicc (has gone to gerrit), 2016/12/07 01:51:42]

TODO(whom): [what to fix] [when]

If this is just "this is sad but we're going to live with it" then I'd just
write a comment to that effect, no FIXME/TODO.

[engedy, 2016/12/07 09:37:41]

At this point I am optimistic that this should be fixable. Filed and referenced
a bug.

+  // breaks the invariant that the layout object attached to this element will
+  // always be appropriate for |m_layoutDisposition|. Force recreate it.
+  // See example: images/content-url-broken-image-with-alt-text.html.
+  setLayoutDisposition(LayoutDisposition::FallbackContent,
+                       true /* forceReattach */);
 }
 
-void HTMLImageElement::ensureFallbackContent() {
-  if (m_useFallbackContent || m_isFallbackImage)
+void HTMLImageElement::ensureCollapsedOrFallbackContent() {
+  if (m_isFallbackImage)
     return;
-  setUseFallbackContent();
-  reattachFallbackContent();
+
+  if (imageLoader().image() &&

[dominicc (has gone to gerrit), 2016/12/07 01:51:42]

Seems OK, but maybe

bool explainingVar = that expression;
setLayoutDisposition(explainingVar ? ... : ...);

is both more succinct and more informative because of the name of explainingVar?

[engedy, 2016/12/07 09:37:40]

Done.

+      imageLoader().image()->resourceError().shouldCollapseInitiator()) {
+    setLayoutDisposition(LayoutDisposition::Collapsed);
+  } else {
+    setLayoutDisposition(LayoutDisposition::FallbackContent);
+  }
 }
 
 void HTMLImageElement::ensurePrimaryContent() {
-  if (!m_useFallbackContent)
-    return;
-  m_useFallbackContent = false;
-  reattachFallbackContent();
+  setLayoutDisposition(LayoutDisposition::PrimaryContent);
 }
 
-void HTMLImageElement::reattachFallbackContent() {
+void HTMLImageElement::setLayoutDisposition(LayoutDisposition layoutDisposition,
+                                            bool forceReattach) {
+  if (m_layoutDisposition == layoutDisposition && !forceReattach)
+    return;
+
+  m_layoutDisposition = layoutDisposition;
+
   // This can happen inside of attachLayoutTree() in the middle of a recalcStyle
   // so we need to reattach synchronously here.
-  if (document().inStyleRecalc())
+  if (document().inStyleRecalc()) {
     reattachLayoutTree();
-  else
+  } else {
+    if (m_layoutDisposition == LayoutDisposition::FallbackContent) {
+      EventDispatchForbiddenScope::AllowUserAgentEvents allowEvents;
+      ensureUserAgentShadowRoot();
+    }
     lazyReattachIfAttached();
+  }
 }
 
 PassRefPtr<ComputedStyle> HTMLImageElement::customStyleForLayoutObject() {
-  RefPtr<ComputedStyle> newStyle = originalStyleForLayoutObject();
-
-  if (!m_useFallbackContent)
-    return newStyle;
-
-  RefPtr<ComputedStyle> style = ComputedStyle::clone(*newStyle);
-  return HTMLImageFallbackHelper::customStyleForAltText(*this, style);
-}
-
-void HTMLImageElement::setUseFallbackContent() {
-  m_useFallbackContent = true;
-  if (document().inStyleRecalc())
-    return;
-  EventDispatchForbiddenScope::AllowUserAgentEvents allowEvents;
-  ensureUserAgentShadowRoot();
+  switch (m_layoutDisposition) {
+    case LayoutDisposition::PrimaryContent:  // Fall through.
+    case LayoutDisposition::Collapsed:
+      return originalStyleForLayoutObject();
+    case LayoutDisposition::FallbackContent:
+      return HTMLImageFallbackHelper::customStyleForAltText(
+          *this, ComputedStyle::clone(*originalStyleForLayoutObject()));
+  }
 }
 
 bool HTMLImageElement::isOpaque() const {
   Image* image = const_cast<HTMLImageElement*>(this)->imageContents();
   return image && image->currentFrameKnownToBeOpaque();
 }
 
 int HTMLImageElement::sourceWidth() {
   SourceImageStatus status;
   FloatSize defaultObjectSize(width(), height());
@@ skipping 16 matching lines @@
   ImageResource* image = cachedImage();
   if (!image)
     return IntSize();
   LayoutSize lSize = image->imageSize(
       LayoutObject::shouldRespectImageOrientation(layoutObject()), 1.0f);
   DCHECK(lSize.fraction().isZero());
   return IntSize(lSize.width().toInt(), lSize.height().toInt());
 }
 
 }  // namespace blink