Check for image content in ImageDocumentParser::Finish

If the <img> element in the image document has had it's source cleared
out (by having its 'src' changed or by moving it to an inactive document
or similar cases) we may not have any image content associated with it
when we reach ImageDocumentParser::Finish (when the original image data
finishes loading). Check if image content exists before updating the
title of the document et cetera.

Bug: 1036686
Change-Id: I5d0e2e52e9373c541e64d33bbaa6c67dd0535092
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1989755Reviewed-by: Stephen Chenney <schenney@chromium.org>
Commit-Queue: Fredrik Söderquist <fs@opera.com>
Cr-Commit-Position: refs/heads/master@{#729743}

third_party/blink/renderer/core/html/image_document.cc

@@ -174,13 +174,15 @@ void ImageDocumentParser::Finish() {
         loader->GetTiming().ResponseEnd(),
         GetDocument()->GetTaskRunner(TaskType::kInternalLoading).get());
 
-    GetDocument()->UpdateTitle();
+    if (GetDocument()->CachedImage()) {
+      GetDocument()->UpdateTitle();
 
-    if (IsDetached())
-      return;
+      if (IsDetached())
+        return;
 
-    GetDocument()->ImageUpdated();
-    GetDocument()->ImageLoaded();
+      GetDocument()->ImageUpdated();
+      GetDocument()->ImageLoaded();
+    }
   }
 
   if (!IsDetached()) {

third_party/blink/renderer/core/html/image_document_test.cc

@@ -83,6 +83,7 @@ class ImageDocumentTest : public testing::Test {
 
   void CreateDocumentWithoutLoadingImage(int view_width, int view_height);
   void CreateDocument(int view_width, int view_height);
+  DocumentParser* StartLoadingImage();
   void LoadImage();
 
   ImageDocument& GetDocument() const;
@@ -126,11 +127,16 @@ ImageDocument& ImageDocumentTest::GetDocument() const {
   return *image_document;
 }
 
-void ImageDocumentTest::LoadImage() {
+DocumentParser* ImageDocumentTest::StartLoadingImage() {
   DocumentParser* parser = GetDocument().ImplicitOpen(
       ParserSynchronizationPolicy::kForceSynchronousParsing);
   const Vector<unsigned char>& data = JpegImage();
   parser->AppendBytes(reinterpret_cast<const char*>(data.data()), data.size());
+  return parser;
+}
+
+void ImageDocumentTest::LoadImage() {
+  DocumentParser* parser = StartLoadingImage();
   parser->Finish();
 }
 
@@ -223,6 +229,13 @@ TEST_F(ImageDocumentTest, DomInteractive) {
   EXPECT_FALSE(GetDocument().GetTiming().DomInteractive().is_null());
 }
 
+TEST_F(ImageDocumentTest, ImageSrcChangedBeforeFinish) {
+  CreateDocumentWithoutLoadingImage(80, 70);
+  DocumentParser* parser = StartLoadingImage();
+  GetDocument().ImageElement()->removeAttribute(html_names::kSrcAttr);
+  parser->Finish();
+}
+
 #if defined(OS_ANDROID)
 #define MAYBE(test) DISABLED_##test
 #else