5 files changed, 25 insertions, 14 deletions

diff --git a/Source/WebCore/svg/SVGImageElement.h b/Source/WebCore/svg/SVGImageElement.h
index f2f8d9b03..4ee7d783c 100644
--- a/Source/WebCore/svg/SVGImageElement.h
+++ b/Source/WebCore/svg/SVGImageElement.h
@@ -22,6 +22,7 @@
 #define SVGImageElement_h
 
 #if ENABLE(SVG)
+#include "ImageLoaderClient.h"
 #include "SVGAnimatedBoolean.h"
 #include "SVGAnimatedLength.h"
 #include "SVGAnimatedPreserveAspectRatio.h"
@@ -38,13 +39,14 @@ class SVGImageElement : public SVGStyledTransformableElement,
                         public SVGTests,
                         public SVGLangSpace,
                         public SVGExternalResourcesRequired,
-                        public SVGURIReference {
+                        public SVGURIReference,
+                        public ImageLoaderClientBase<SVGImageElement> {
 public:
     static PassRefPtr<SVGImageElement> create(const QualifiedName&, Document*);
 
 private:
     SVGImageElement(const QualifiedName&, Document*);
-    
+
     virtual bool isValid() const { return SVGTests::isValid(); }
     virtual bool supportsFocus() const { return true; }
 
diff --git a/Source/WebCore/svg/SVGImageLoader.cpp b/Source/WebCore/svg/SVGImageLoader.cpp
index 4f33d569e..290acdb88 100644
--- a/Source/WebCore/svg/SVGImageLoader.cpp
+++ b/Source/WebCore/svg/SVGImageLoader.cpp
@@ -26,22 +26,23 @@
 #include "Event.h"
 #include "EventNames.h"
 #include "HTMLParserIdioms.h"
+#include "ImageLoaderClient.h"
 #include "RenderImage.h"
 #include "SVGImageElement.h"
 
 namespace WebCore {
 
-SVGImageLoader::SVGImageLoader(SVGImageElement* node)
-    : ImageLoader(node)
+SVGImageLoader::SVGImageLoader(ImageLoaderClient* client)
+    : ImageLoader(client)
 {
 }
 
 void SVGImageLoader::dispatchLoadEvent()
 {
     if (image()->errorOccurred())
-        element()->dispatchEvent(Event::create(eventNames().errorEvent, false, false));
+        client()->imageElement()->dispatchEvent(Event::create(eventNames().errorEvent, false, false));
     else {
-        SVGImageElement* imageElement = static_cast<SVGImageElement*>(element());
+        SVGImageElement* imageElement = static_cast<SVGImageElement*>(client()->imageElement());
         if (imageElement->externalResourcesRequiredBaseValue())
             imageElement->sendSVGLoadEventIfPossible(true);
     }
@@ -49,10 +50,10 @@ void SVGImageLoader::dispatchLoadEvent()
 
 String SVGImageLoader::sourceURI(const AtomicString& attribute) const
 {
-    KURL base = element()->baseURI();
+    KURL base = client()->sourceElement()->baseURI();
     if (base.isValid())
         return KURL(base, stripLeadingAndTrailingHTMLSpaces(attribute)).string();
-    return element()->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(attribute));
+    return client()->sourceElement()->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(attribute));
 }
 
 }
diff --git a/Source/WebCore/svg/SVGImageLoader.h b/Source/WebCore/svg/SVGImageLoader.h
index b7a16175c..d617cd850 100644
--- a/Source/WebCore/svg/SVGImageLoader.h
+++ b/Source/WebCore/svg/SVGImageLoader.h
@@ -29,7 +29,7 @@ class SVGImageElement;
 
 class SVGImageLoader : public ImageLoader {
 public:
-    SVGImageLoader(SVGImageElement*);
+    SVGImageLoader(ImageLoaderClient*);
 
 private:
     virtual void dispatchLoadEvent();
diff --git a/Source/WebCore/svg/SVGStopElement.cpp b/Source/WebCore/svg/SVGStopElement.cpp
index 87143ee62..5b0e69de3 100644
--- a/Source/WebCore/svg/SVGStopElement.cpp
+++ b/Source/WebCore/svg/SVGStopElement.cpp
@@ -113,10 +113,14 @@ bool SVGStopElement::rendererIsNeeded(const NodeRenderingContext&)
 
 Color SVGStopElement::stopColorIncludingOpacity() const
 {
-    ASSERT(renderer());
-    ASSERT(renderer()->style());
-
-    const SVGRenderStyle* svgStyle = renderer()->style()->svgStyle();
+    RenderStyle* style = renderer() ? renderer()->style() : 0;
+    // FIXME: This check for null style exists to address Bug WK 90814, a rare crash condition in
+    // which the renderer or style is null. This entire class is scheduled for removal (Bug WK 86941)
+    // and we will tolerate this null check until then.
+    if (!style || !style->svgStyle())
+        return Color(Color::transparent, true); // Transparent black.
+
+    const SVGRenderStyle* svgStyle = style->svgStyle();
     return colorWithOverrideAlpha(svgStyle->stopColor().rgb(), svgStyle->stopOpacity());
 }
 
diff --git a/Source/WebCore/svg/animation/SVGSMILElement.cpp b/Source/WebCore/svg/animation/SVGSMILElement.cpp
index d59cfffd4..0dc6a8a5d 100644
--- a/Source/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/Source/WebCore/svg/animation/SVGSMILElement.cpp
@@ -1043,7 +1043,11 @@ bool SVGSMILElement::progress(SMILTime elapsed, SVGSMILElement* resultElement, b
     // This call may obtain a new interval -- never call calculateAnimationPercentAndRepeat() before!
     if (seekToTime) {
         seekToIntervalCorrespondingToTime(elapsed);
-        ASSERT(elapsed >= m_intervalBegin);
+        if (elapsed < m_intervalBegin) {
+            // elapsed is not within an interval.
+            m_nextProgressTime = m_intervalBegin;
+            return false;
+        }
     }
 
     unsigned repeat = 0;