Merge webkit.org at r54731 : Initial merge by git

Change-Id: Ia79977b6cf3b0b00c06ef39419989b28e57e4f4a

1 files changed, 50 insertions, 12 deletions

diff --git a/WebCore/loader/ImageLoader.cpp b/WebCore/loader/ImageLoader.cpp
index 9c237cd..c61d133 100644
--- a/WebCore/loader/ImageLoader.cpp
+++ b/WebCore/loader/ImageLoader.cpp
@@ -29,6 +29,24 @@
 #include "Element.h"
 #include "RenderImage.h"
 
+#if !ASSERT_DISABLED
+// ImageLoader objects are allocated as members of other objects, so generic pointer check would always fail.
+namespace WTF {
+
+template<> struct ValueCheck<WebCore::ImageLoader*> {
+    typedef WebCore::ImageLoader* TraitType;
+    static void checkConsistency(const WebCore::ImageLoader* p)
+    {
+        if (!p)
+            return;
+        ASSERT(p->element());
+        ValueCheck<WebCore::Element*>::checkConsistency(p->element());
+    }
+};
+
+}
+#endif
+
 namespace WebCore {
 
 class ImageEventSender : public Noncopyable {
@@ -40,6 +58,10 @@ public:
 
     void dispatchPendingEvents();
 
+#if !ASSERT_DISABLED
+    bool hasPendingEvents(ImageLoader* loader) { return m_dispatchSoonList.find(loader) != notFound; }
+#endif
+
 private:
     void timerFired(Timer<ImageEventSender>*);
 
@@ -75,8 +97,12 @@ ImageLoader::~ImageLoader()
 {
     if (m_image)
         m_image->removeClient(this);
+
+    ASSERT(!m_firedBeforeLoad || !beforeLoadEventSender().hasPendingEvents(this));
     if (!m_firedBeforeLoad)
         beforeLoadEventSender().cancelEvent(this);
+
+    ASSERT(!m_firedLoad || !loadEventSender().hasPendingEvents(this));
     if (!m_firedLoad)
         loadEventSender().cancelEvent(this);
 }
@@ -86,9 +112,15 @@ void ImageLoader::setImage(CachedImage* newImage)
     ASSERT(m_failedLoadURL.isEmpty());
     CachedImage* oldImage = m_image.get();
     if (newImage != oldImage) {
-        setLoadingImage(newImage);
-        m_firedBeforeLoad = true;
-        m_firedLoad = true;
+        m_image = newImage;
+        if (!m_firedBeforeLoad) {
+            beforeLoadEventSender().cancelEvent(this);
+            m_firedBeforeLoad = true;
+        }
+        if (!m_firedLoad) {
+            loadEventSender().cancelEvent(this);
+            m_firedLoad = true;
+        }
         m_imageComplete = true;
         if (newImage)
             newImage->addClient(this);
@@ -103,14 +135,6 @@ void ImageLoader::setImage(CachedImage* newImage)
     }
 }
 
-void ImageLoader::setLoadingImage(CachedImage* loadingImage)
-{
-    m_image = loadingImage;
-    m_firedBeforeLoad = !loadingImage;
-    m_firedLoad = !loadingImage;
-    m_imageComplete = !loadingImage;
-}
-
 void ImageLoader::updateFromElement()
 {
     // If we're not making renderers for the page, then don't load images.  We don't want to slow
@@ -146,7 +170,16 @@ void ImageLoader::updateFromElement()
     
     CachedImage* oldImage = m_image.get();
     if (newImage != oldImage) {
-        setLoadingImage(newImage);
+        if (!m_firedBeforeLoad)
+            beforeLoadEventSender().cancelEvent(this);
+        if (!m_firedLoad)
+            loadEventSender().cancelEvent(this);
+
+        m_image = newImage;
+        m_firedBeforeLoad = !newImage;
+        m_firedLoad = !newImage;
+        m_imageComplete = !newImage;
+
         if (newImage) {
             newImage->addClient(this);
             if (!m_element->document()->hasListenerType(Document::BEFORELOAD_LISTENER))
@@ -180,6 +213,9 @@ void ImageLoader::notifyFinished(CachedResource*)
     if (haveFiredBeforeLoadEvent())
         updateRenderer();
 
+    if (m_firedLoad)
+        return;
+
     loadEventSender().dispatchEventSoon(this);
 }
 
@@ -282,6 +318,8 @@ void ImageEventSender::dispatchPendingEvents()
 
     m_timer.stop();
 
+    m_dispatchSoonList.checkConsistency();
+
     m_dispatchingList.swap(m_dispatchSoonList);
     size_t size = m_dispatchingList.size();
     for (size_t i = 0; i < size; ++i) {