Merge 94905 - Source/WebCore: Crash due to bad data in SVGDocumentExtensions m_pendingResources

Source/WebCore/svg/SVGDocumentExtensions.cpp

 /*
  * Copyright (C) 2006 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2007 Rob Buis <buis@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 209 matching lines @@
 
     if (m_pendingResources.contains(id))
         m_pendingResources.get(id)->add(element);
     else {
         SVGPendingElements* set = new SVGPendingElements;
         set->add(element);
 
         m_pendingResources.add(id, set);
     }
 
-    element->setHasPendingResources(true);
+    element->setHasPendingResources();
 }
 
 bool SVGDocumentExtensions::hasPendingResources(const AtomicString& id) const
 {
     if (id.isEmpty())
         return false;
 
     return m_pendingResources.contains(id);
 }
 
+bool SVGDocumentExtensions::isElementInPendingResources(SVGStyledElement* element) const
+{
+    ASSERT(element);
+
+    if (m_pendingResources.isEmpty())
+        return false;
+
+    HashMap<AtomicString, SVGPendingElements*>::const_iterator end = m_pendingResources.end();
+    for (HashMap<AtomicString, SVGPendingElements*>::const_iterator it = m_pendingResources.begin(); it != end; ++it) {
+        SVGPendingElements* elements = it->second;
+        ASSERT(elements);
+
+        if (elements->contains(element))
+            return true;
+    }
+    return false;
+}
+
 void SVGDocumentExtensions::removeElementFromPendingResources(SVGStyledElement* element)
 {
     ASSERT(element);
 
     if (m_pendingResources.isEmpty() || !element->hasPendingResources())
         return;
 
-    element->setHasPendingResources(false);
-
     Vector<AtomicString> toBeRemoved;
     HashMap<AtomicString, SVGPendingElements*>::iterator end = m_pendingResources.end();
     for (HashMap<AtomicString, SVGPendingElements*>::iterator it = m_pendingResources.begin(); it != end; ++it) {
         SVGPendingElements* elements = it->second;
         ASSERT(elements);
         ASSERT(!elements->isEmpty());
 
         elements->remove(element);
         if (elements->isEmpty())
             toBeRemoved.append(it->first);
     }
 
+    element->clearHasPendingResourcesIfPossible();
+
     if (toBeRemoved.isEmpty())
         return;
 
     Vector<AtomicString>::iterator endVector = toBeRemoved.end();
     for (Vector<AtomicString>::iterator it = toBeRemoved.begin(); it != endVector; ++it)
         m_pendingResources.remove(*it);
 }
 
 PassOwnPtr<SVGDocumentExtensions::SVGPendingElements> SVGDocumentExtensions::removePendingResource(const AtomicString& id)
 {
     ASSERT(m_pendingResources.contains(id));
 
     OwnPtr<SVGPendingElements> set = adoptPtr(m_pendingResources.get(id));
     m_pendingResources.remove(id);
     return set.release();
 }
 
 }
 
 #endif