Merge 116693 - Crash in computedCSSPadding* functions due to RenderImage::imageDimensionsChanged ca…

Merge 116693 - Crash in computedCSSPadding* functions due to RenderImage::imageDimensionsChanged called during attachment
https://bugs.webkit.org/show_bug.cgi?id=85912

Reviewed by Eric Seidel.

Source/WebCore:

Tests: fast/images/link-body-content-imageDimensionChanged-crash.html
       fast/images/script-counter-imageDimensionChanged-crash.html

The bug comes from CSS generated images that could end up calling imageDimensionsChanged during attachment. As the
rest of the code (e.g. computedCSSPadding*) would assumes that we are already inserted in the tree, we would crash.

The solution is to bail out in this case as newly inserted RenderObject will trigger layout later on and properly
handle what we would be doing as part of imageDimensionChanged (the only exception being updating our intrinsic
size which should be done as part of imageDimensionsChanged).

* rendering/RenderImage.cpp:
(WebCore::RenderImage::imageDimensionsChanged):

LayoutTests:

* fast/images/link-body-content-imageDimensionChanged-crash-expected.txt: Added.
* fast/images/link-body-content-imageDimensionChanged-crash.html: Added.
* fast/images/script-counter-imageDimensionChanged-crash-expected.txt: Added.
* fast/images/script-counter-imageDimensionChanged-crash.html: Added.


TBR=jchaffraix@webkit.org
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=116968