Bug fix: Fix wrong assumption in ImageResource when adding observer

third_party/WebKit/Source/core/fetch/ImageResource.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
     Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ skipping 99 matching lines @@
     HashCountedSet<ImageResourceObserver*> observers;
     m_observers.swap(observers);
     for (const auto& it : observers)
         m_finishedObservers.add(it.key, it.value);
 
     Resource::markClientsAndObserversFinished();
 }
 
 void ImageResource::didAddClient(ResourceClient* client)
 {
-    DCHECK(!m_data || m_image);
+    DCHECK((m_multipartParser && isLoading()) || !m_data || m_image);
     Resource::didAddClient(client);
 }
 
 void ImageResource::addObserver(ImageResourceObserver* observer)
 {
     willAddClientOrObserver();
 
     m_observers.add(observer);
 
     if (isCacheValidator())
         return;
 
-    DCHECK(!m_data || m_image);
+    // When the response is not multipart, if |m_data| exists, |m_image| must
+    // be created. This is assured that |updateImage()| is called when
+    // |appendData()| is called.
+    //
+    // On the other hand, when the response is multipart, |updateImage()| is
+    // not called in |appendData()|, which means |m_image| might not be created
+    // even when |m_data| exists. This is intentional since creating a |m_image|
+    // on receiving data might destroy an existing image in a previous part.
+    DCHECK((m_multipartParser && isLoading()) || !m_data || m_image);
 
     if (m_image && !m_image->isNull()) {
         observer->imageChanged(this);
     }
 
     if (isLoaded()) {
         observer->imageNotifyFinished(this);
         if (m_observers.contains(observer)) {
             m_finishedObservers.add(observer);
             m_observers.remove(observer);
@@ skipping 441 matching lines @@
     if (response().wasFetchedViaServiceWorker())
         return response().serviceWorkerResponseType() != WebServiceWorkerResponseTypeOpaque;
     if (!getImage()->currentFrameHasSingleSecurityOrigin())
         return false;
     if (passesAccessControlCheck(securityOrigin))
         return true;
     return !securityOrigin->taintsCanvas(response().url());
 }
 
 } // namespace blink