Merge 94905 - Source/WebCore: Crash due to bad data in SVGDocumentExtensions m_pendingResources

Source/WebCore/svg/SVGStyledElement.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2007, 2008 Rob Buis <buis@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 371 matching lines @@
     if (!extensions->hasPendingResources(resourceId))
         return;
 
     OwnPtr<SVGDocumentExtensions::SVGPendingElements> clients(extensions->removePendingResource(resourceId));
     ASSERT(!clients->isEmpty());
 
     const SVGDocumentExtensions::SVGPendingElements::const_iterator end = clients->end();
     for (SVGDocumentExtensions::SVGPendingElements::const_iterator it = clients->begin(); it != end; ++it) {
         ASSERT((*it)->hasPendingResources());
         (*it)->buildPendingResource();
-        (*it)->setHasPendingResources(false);
+        (*it)->clearHasPendingResourcesIfPossible();
     }
 }
 
 void SVGStyledElement::removedFromDocument()
 {
     updateRelativeLengthsInformation(false, this);
     SVGElement::removedFromDocument();
 
     Document* document = this->document();
     if (!needsPendingResourceHandling() || !document)
@@ skipping 45 matching lines @@
 {
     if (hasRareSVGData())
         rareSVGData()->setInstanceUpdatesBlocked(value);
 }
 
 bool SVGStyledElement::hasPendingResources() const
 {
     return hasRareSVGData() && rareSVGData()->hasPendingResources();
 }
 
-void SVGStyledElement::setHasPendingResources(bool value)
+void SVGStyledElement::setHasPendingResources()
 {
-    ensureRareSVGData()->setHasPendingResources(value);
+    ensureRareSVGData()->setHasPendingResources(true);
+}
+
+void SVGStyledElement::clearHasPendingResourcesIfPossible()
+{
+    if (!document()->accessSVGExtensions()->isElementInPendingResources(this))
+        ensureRareSVGData()->setHasPendingResources(false);
 }
 
 AffineTransform SVGStyledElement::localCoordinateSpaceTransform(SVGLocatable::CTMScope) const
 {
     // To be overriden by SVGStyledLocatableElement/SVGStyledTransformableElement (or as special case SVGTextElement)
     ASSERT_NOT_REACHED();
     return AffineTransform();
 }
 
 void SVGStyledElement::updateRelativeLengthsInformation(bool hasRelativeLengths, SVGStyledElement* element)
@@ skipping 44 matching lines @@
 }
 
 bool SVGStyledElement::isKeyboardFocusable(KeyboardEvent*) const
 {
     return isMouseFocusable();
 }
 
 }
 
 #endif // ENABLE(SVG)