Check that SVGImage is loaded in ImageNotifyFinished()

third_party/WebKit/Source/core/loader/ImageLoader.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010 Apple Inc. All rights
  * reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 544 matching lines @@
 
   image_complete_ = true;
   delay_until_image_notify_finished_ = nullptr;
 
   // Update ImageAnimationPolicy for image_.
   if (image_)
     image_->UpdateImageAnimationPolicy();
 
   UpdateLayoutObject();
 
-  if (image_ && image_->GetImage() && image_->GetImage()->IsSVGImage())
+  if (image_ && image_->GetImage() && image_->GetImage()->IsSVGImage()) {
+    // SVG's document should be completely loaded before access control
+    // checks, which can occur anytime after ImageNotifyFinished()
+    // (See SVGImage::CurrentFrameHasSingleSecurityOrigin()).
+    // We check the document is loaded here to catch violation of the
+    // assumption reliably.
+    ToSVGImage(image_->GetImage())->CheckLoaded();
+
     ToSVGImage(image_->GetImage())
         ->UpdateUseCounters(GetElement()->GetDocument());
+  }
 
   if (loading_image_document_) {
     CHECK(!has_pending_load_event_);
     return;
   }
 
   CHECK(has_pending_load_event_);
 
   if (resource->ErrorOccurred()) {
     LoadEventSender().CancelEvent(this);
@@ skipping 143 matching lines @@
   }
   if (delay_until_image_notify_finished_) {
     delay_until_image_notify_finished_->DocumentChanged(
         element_->GetDocument());
   }
   ClearFailedLoadURL();
   ClearImage();
 }
 
 }  // namespace blink