Merge 94905 - Source/WebCore: Crash due to bad data in SVGDocumentExtensions m_pendingResources

Source/WebCore/svg/SVGStyledElement.cpp

Index: Source/WebCore/svg/SVGStyledElement.cpp
===================================================================
--- Source/WebCore/svg/SVGStyledElement.cpp	(revision 95993)
+++ Source/WebCore/svg/SVGStyledElement.cpp	(working copy)
@@ -389,7 +389,7 @@
     for (SVGDocumentExtensions::SVGPendingElements::const_iterator it = clients->begin(); it != end; ++it) {
         ASSERT((*it)->hasPendingResources());
         (*it)->buildPendingResource();
-        (*it)->setHasPendingResources(false);
+        (*it)->clearHasPendingResourcesIfPossible();
     }
 }
 
@@ -455,11 +455,17 @@
     return hasRareSVGData() && rareSVGData()->hasPendingResources();
 }
 
-void SVGStyledElement::setHasPendingResources(bool value)
+void SVGStyledElement::setHasPendingResources()
 {
-    ensureRareSVGData()->setHasPendingResources(value);
+    ensureRareSVGData()->setHasPendingResources(true);
 }
 
+void SVGStyledElement::clearHasPendingResourcesIfPossible()
+{
+    if (!document()->accessSVGExtensions()->isElementInPendingResources(this))
+        ensureRareSVGData()->setHasPendingResources(false);
+}
+
 AffineTransform SVGStyledElement::localCoordinateSpaceTransform(SVGLocatable::CTMScope) const
 {
     // To be overriden by SVGStyledLocatableElement/SVGStyledTransformableElement (or as special case SVGTextElement)
Property changes on: Source\WebCore\svg\SVGStyledElement.cpp
___________________________________________________________________
Added: svn:executable
   + *