Check that SVGImage is loaded in ImageNotifyFinished()

third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp

Index: third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp
diff --git a/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp b/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp
index 8c34ea90b7adca781799ab40528b5f1a96055a91..916ed6ef70eae575a8176344e5200d1151d503e2 100644
--- a/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp
+++ b/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp
@@ -30,6 +30,7 @@
 #include "core/animation/DocumentAnimations.h"
 #include "core/animation/DocumentTimeline.h"
 #include "core/dom/NodeTraversal.h"
+#include "core/dom/TaskRunnerHelper.h"
 #include "core/dom/shadow/FlatTreeTraversal.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
@@ -120,13 +121,21 @@ bool SVGImage::IsInSVGImage(const Node* node) {
   return page->GetChromeClient().IsSVGImageChromeClient();
 }
 
+void SVGImage::CheckLoaded() const {
+  CHECK(page_);
+
+  LocalFrame* frame = ToLocalFrame(page_->MainFrame());
+
+  CHECK(frame->GetDocument()->LoadEventFinished());
+}
+
 bool SVGImage::CurrentFrameHasSingleSecurityOrigin() const {
   if (!page_)
     return true;
 
   LocalFrame* frame = ToLocalFrame(page_->MainFrame());
 
-  CHECK(frame->GetDocument()->LoadEventFinished());
+  CheckLoaded();
 
   SVGSVGElement* root_element =
       frame->GetDocument()->AccessSVGExtensions().rootElement();
@@ -640,8 +649,15 @@ void SVGImage::LoadCompleted() {
 
     case kWaitingForAsyncLoadCompletion:
       load_state_ = kLoadCompleted;
-      if (GetImageObserver())
-        GetImageObserver()->AsyncLoadCompleted(this);
+      if (GetImageObserver()) {
+        TaskRunnerHelper::Get(TaskType::kDOMManipulation,
+                              ToLocalFrame(page_->MainFrame())->GetDocument())
+            ->PostTask(
+                BLINK_FROM_HERE,
+                WTF::Bind(&ImageObserver::AsyncLoadCompleted,
+                          WeakPersistent<ImageObserver>(GetImageObserver()),
+                          RefPtr<SVGImage>(this)));
+      }
       break;
 
     case kDataChangedNotStarted: