Don't allow for negative document time

SVGSVGElement now overrides DidMoveToNewDocument to make sure there
isn't a possibility that the document time is negative. The document
time could be negative in the old patches when the document was
moved to a different iframe when playing. This should take care
of that problem.

No other functionality was changed.

Bug: 996196
Change-Id: I10a0737b68c8a08eeb0528cc8698405870924272
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1768336
Commit-Queue: Edvard Thörnros <edvardt@opera.com>
Commit-Queue: Fredrik Söderquist <fs@opera.com>
Reviewed-by: Fredrik Söderquist <fs@opera.com>
Auto-Submit: Edvard Thörnros <edvardt@opera.com>
Cr-Commit-Position: refs/heads/master@{#689913}

third_party/blink/renderer/core/svg/animation/smil_time_container.cc

@@ -151,12 +151,28 @@ double SMILTimeContainer::Elapsed() const {
   if (IsPaused())
     return presentation_time_;
 
-  return presentation_time_ + (GetDocument()
-                                   .Timeline()
-                                   .CurrentTimeInternal()
-                                   .value_or(base::TimeDelta())
-                                   .InSecondsF() -
-                               reference_time_);
+  double elapsed = presentation_time_ + (GetDocument()
+                                             .Timeline()
+                                             .CurrentTimeInternal()
+                                             .value_or(base::TimeDelta())
+                                             .InSecondsF() -
+                                         reference_time_);
+  DCHECK_GE(elapsed, 0.0);
+  return elapsed;
+}
+
+void SMILTimeContainer::ResetDocumentTime() {
+  DCHECK(IsStarted());
+  // TODO(edvardt): We actually want to check if
+  // the document is active and we don't have any special
+  // conditions and such, but they require more fixing,
+  // probably in SVGSVGElement. I suspect there's a large
+  // bug buried here somewhere. This is enough to "paper over"
+  // it, but it's not really a solution.
+  //
+  // Bug: 996196
+
+  SynchronizeToDocumentTimeline();
 }
 
 void SMILTimeContainer::SynchronizeToDocumentTimeline() {

third_party/blink/renderer/core/svg/animation/smil_time_container.h

@@ -69,6 +69,7 @@ class SMILTimeContainer : public GarbageCollectedFinalized<SMILTimeContainer> {
   void ServiceAnimations();
   bool HasAnimations() const;
 
+  void ResetDocumentTime();
   void SetDocumentOrderIndexesDirty() { document_order_indexes_dirty_ = true; }
 
   // Advance the animation timeline a single frame.

third_party/blink/renderer/core/svg/svg_svg_element.cc

@@ -343,6 +343,13 @@ bool SVGSVGElement::CheckIntersectionOrEnclosure(
   return result;
 }
 
+void SVGSVGElement::DidMoveToNewDocument(Document& old_document) {
+  SVGGraphicsElement::DidMoveToNewDocument(old_document);
+  if (TimeContainer()->IsStarted()) {
+    TimeContainer()->ResetDocumentTime();
+  }
+}
+
 StaticNodeList* SVGSVGElement::CollectIntersectionOrEnclosureList(
     const FloatRect& rect,
     SVGElement* reference_element,

third_party/blink/renderer/core/svg/svg_svg_element.h

@@ -133,6 +133,8 @@ class SVGSVGElement final : public SVGGraphicsElement,
 
   void SvgAttributeChanged(const QualifiedName&) override;
 
+  void DidMoveToNewDocument(Document& old_document) override;
+
   bool SelfHasRelativeLengths() const override;
 
   bool ShouldSynthesizeViewBox() const;