Check that SVGImage is loaded in ImageNotifyFinished()

third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp

 /*
  * Copyright (C) 2006 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 12 matching lines @@
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "core/svg/graphics/SVGImage.h"
 
 #include "core/animation/DocumentAnimations.h"
 #include "core/animation/DocumentTimeline.h"
 #include "core/dom/NodeTraversal.h"
+#include "core/dom/TaskRunnerHelper.h"
 #include "core/dom/shadow/FlatTreeTraversal.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/LocalFrameClient.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutView.h"
 #include "core/layout/svg/LayoutSVGRoot.h"
 #include "core/loader/FrameLoadRequest.h"
 #include "core/paint/FloatClipRecorder.h"
 #include "core/paint/TransformRecorder.h"
@@ skipping 70 matching lines @@
 bool SVGImage::IsInSVGImage(const Node* node) {
   DCHECK(node);
 
   Page* page = node->GetDocument().GetPage();
   if (!page)
     return false;
 
   return page->GetChromeClient().IsSVGImageChromeClient();
 }
 
+void SVGImage::CheckLoaded() const {
+  CHECK(page_);
+
+  LocalFrame* frame = ToLocalFrame(page_->MainFrame());
+
+  CHECK(frame->GetDocument()->LoadEventFinished());
+}
+
 bool SVGImage::CurrentFrameHasSingleSecurityOrigin() const {
   if (!page_)
     return true;
 
   LocalFrame* frame = ToLocalFrame(page_->MainFrame());
 
-  CHECK(frame->GetDocument()->LoadEventFinished());
+  CheckLoaded();
 
   SVGSVGElement* root_element =
       frame->GetDocument()->AccessSVGExtensions().rootElement();
   if (!root_element)
     return true;
 
   // Don't allow foreignObject elements or images that are not known to be
   // single-origin since these can leak cross-origin information.
   for (Node* node = root_element; node; node = FlatTreeTraversal::Next(*node)) {
     if (isSVGForeignObjectElement(*node))
@@ skipping 493 matching lines @@
 }
 
 void SVGImage::LoadCompleted() {
   switch (load_state_) {
     case kInDataChanged:
       load_state_ = kLoadCompleted;
       break;
 
     case kWaitingForAsyncLoadCompletion:
       load_state_ = kLoadCompleted;
-      if (GetImageObserver())
-        GetImageObserver()->AsyncLoadCompleted(this);
+      if (GetImageObserver()) {
+        TaskRunnerHelper::Get(TaskType::kDOMManipulation,
+                              ToLocalFrame(page_->MainFrame())->GetDocument())
+            ->PostTask(
+                BLINK_FROM_HERE,
+                WTF::Bind(&ImageObserver::AsyncLoadCompleted,
+                          WeakPersistent<ImageObserver>(GetImageObserver()),
+                          RefPtr<SVGImage>(this)));
+      }
       break;
 
     case kDataChangedNotStarted:
     case kLoadCompleted:
       CHECK(false);
       break;
   }
 }
 
 Image::SizeAvailability SVGImage::DataChanged(bool all_data_received) {
@@ skipping 104 matching lines @@
 
   NOTREACHED();
   return kSizeAvailable;
 }
 
 String SVGImage::FilenameExtension() const {
   return "svg";
 }
 
 }  // namespace blink