Replace RawPtr with RefPtr on StylePendingImage

This change ensures StylePendingImages set on ComputedStyles will keep
their corresponding CSSValue alive.
The PendingImagePropertyMap on ElementStyleResources was supposed to do
this however it only keeps alive one per property while properties can
have any number of images set on them (background-image).

Prior to this change StylePendingImages held a RawPtr to their CSSValue
to avoid a ref loop because the CSSValue would hold a RefPtr to the
StylePendingImage as a cache.

After this change StylePendingImages hold RefPtrs to their CSSValue
while CSSValues no longer cache StylePendingImages. Having multiple
StylePendingImages per CSSValue is equivalent to using cached
StylePendingImages as no state changes on the StylePendingImage
during the StyleResourceLoader pass.

The old scenario is not currently a problem as all applied CSSValues
have their refs held elsewhere (style rules or AnimatableImages).
Future animation work intends to apply temporary CSSValue images and
must ensure StylePendingImages keep a ref to avoid a use after free.

This patch is a refactor towards memory management correctness and has
no behavioural changes.

BUG=437696

Review URL: https://codereview.chromium.org/1368613002

Cr-Commit-Position: refs/heads/master@{#350808}

12 files changed, 135 insertions, 155 deletions

diff --git a/third_party/WebKit/Source/core/css/CSSCrossfadeValue.cpp b/third_party/WebKit/Source/core/css/CSSCrossfadeValue.cpp
index 3816da2..d4a3208 100644
--- a/third_party/WebKit/Source/core/css/CSSCrossfadeValue.cpp
+++ b/third_party/WebKit/Source/core/css/CSSCrossfadeValue.cpp
@@ -37,7 +37,7 @@ namespace blink {
 static bool subimageIsPending(CSSValue* value)
 {
     if (value->isImageValue())
-        return toCSSImageValue(value)->cachedOrPendingImage()->isPendingImage();
+        return toCSSImageValue(value)->isCachePending();
 
     if (value->isImageGeneratorValue())
         return toCSSImageGeneratorValue(value)->isPending();
@@ -66,7 +66,7 @@ static ImageResource* cachedImageForCSSValue(CSSValue* value, Document* document
         return nullptr;
 
     if (value->isImageValue()) {
-        StyleFetchedImage* styleImageResource = toCSSImageValue(value)->cachedImage(document);
+        StyleFetchedImage* styleImageResource = toCSSImageValue(value)->cacheImage(document);
         if (!styleImageResource)
             return nullptr;
 
diff --git a/third_party/WebKit/Source/core/css/CSSCursorImageValue.cpp b/third_party/WebKit/Source/core/css/CSSCursorImageValue.cpp
index 3f30a4f..bf6606d 100644
--- a/third_party/WebKit/Source/core/css/CSSCursorImageValue.cpp
+++ b/third_party/WebKit/Source/core/css/CSSCursorImageValue.cpp
@@ -28,7 +28,6 @@
 #include "core/style/StyleFetchedImage.h"
 #include "core/style/StyleFetchedImageSet.h"
 #include "core/style/StyleImage.h"
-#include "core/style/StylePendingImage.h"
 #include "core/svg/SVGCursorElement.h"
 #include "core/svg/SVGLengthContext.h"
 #include "core/svg/SVGURIReference.h"
@@ -49,7 +48,7 @@ CSSCursorImageValue::CSSCursorImageValue(PassRefPtrWillBeRawPtr<CSSValue> imageV
     , m_imageValue(imageValue)
     , m_hotSpotSpecified(hotSpotSpecified)
     , m_hotSpot(hotSpot)
-    , m_accessedImage(false)
+    , m_isCachePending(true)
 {
 }
 
@@ -117,13 +116,30 @@ bool CSSCursorImageValue::updateIfSVGCursorIsUsed(Element* element)
     return false;
 }
 
-StyleImage* CSSCursorImageValue::cachedImage(Document* document, float deviceScaleFactor)
+bool CSSCursorImageValue::isCachePending(float deviceScaleFactor) const
 {
+    // Need to delegate completely so that changes in device scale factor can be handled appropriately.
     if (m_imageValue->isImageSetValue())
-        return toCSSImageSetValue(m_imageValue.get())->cachedImageSet(document, deviceScaleFactor);
+        return toCSSImageSetValue(*m_imageValue).isCachePending(deviceScaleFactor);
+    return m_isCachePending;
+}
 
-    if (!m_accessedImage) {
-        m_accessedImage = true;
+StyleImage* CSSCursorImageValue::cachedImage(float deviceScaleFactor)
+{
+    ASSERT(!isCachePending(deviceScaleFactor));
+
+    if (m_imageValue->isImageSetValue())
+        return toCSSImageSetValue(*m_imageValue).cachedImageSet(deviceScaleFactor);
+    return m_cachedImage.get();
+}
+
+StyleImage* CSSCursorImageValue::cacheImage(Document* document, float deviceScaleFactor)
+{
+    if (m_imageValue->isImageSetValue())
+        return toCSSImageSetValue(*m_imageValue).cacheImageSet(document, deviceScaleFactor);
+
+    if (m_isCachePending) {
+        m_isCachePending = false;
 
         // For SVG images we need to lazily substitute in the correct URL. Rather than attempt
         // to change the URL of the CSSImageValue (which would then change behavior like cssText),
@@ -134,33 +150,21 @@ StyleImage* CSSCursorImageValue::cachedImage(Document* document, float deviceSca
             if (SVGCursorElement* cursorElement = resourceReferencedByCursorElement(imageValue->url(), *document)) {
                 RefPtrWillBeRawPtr<CSSImageValue> svgImageValue = CSSImageValue::create(document->completeURL(cursorElement->href()->currentValue()->value()));
                 svgImageValue->setReferrer(imageValue->referrer());
-                StyleFetchedImage* cachedImage = svgImageValue->cachedImage(document);
-                m_image = cachedImage;
+                StyleFetchedImage* cachedImage = svgImageValue->cacheImage(document);
+                m_cachedImage = cachedImage;
                 return cachedImage;
             }
         }
 
         if (m_imageValue->isImageValue())
-            m_image = toCSSImageValue(m_imageValue.get())->cachedImage(document);
+            m_cachedImage = toCSSImageValue(*m_imageValue).cacheImage(document);
     }
 
-    if (m_image && m_image->isImageResource())
-        return toStyleFetchedImage(m_image);
+    if (m_cachedImage && m_cachedImage->isImageResource())
+        return toStyleFetchedImage(m_cachedImage);
     return nullptr;
 }
 
-StyleImage* CSSCursorImageValue::cachedOrPendingImage(float deviceScaleFactor)
-{
-    // Need to delegate completely so that changes in device scale factor can be handled appropriately.
-    if (m_imageValue->isImageSetValue())
-        return toCSSImageSetValue(m_imageValue.get())->cachedOrPendingImageSet(deviceScaleFactor);
-
-    if (!m_image)
-        m_image = StylePendingImage::create(this);
-
-    return m_image.get();
-}
-
 bool CSSCursorImageValue::isSVGCursor() const
 {
     if (m_imageValue->isImageValue()) {
@@ -173,15 +177,15 @@ bool CSSCursorImageValue::isSVGCursor() const
 
 String CSSCursorImageValue::cachedImageURL()
 {
-    if (!m_image || !m_image->isImageResource())
+    if (!m_cachedImage || !m_cachedImage->isImageResource())
         return String();
-    return toStyleFetchedImage(m_image)->cachedImage()->url().string();
+    return toStyleFetchedImage(m_cachedImage)->cachedImage()->url().string();
 }
 
 void CSSCursorImageValue::clearImageResource()
 {
-    m_image = nullptr;
-    m_accessedImage = false;
+    m_cachedImage = nullptr;
+    m_isCachePending = true;
 }
 
 #if !ENABLE(OILPAN)
@@ -200,7 +204,7 @@ bool CSSCursorImageValue::equals(const CSSCursorImageValue& other) const
 DEFINE_TRACE_AFTER_DISPATCH(CSSCursorImageValue)
 {
     visitor->trace(m_imageValue);
-    visitor->trace(m_image);
+    visitor->trace(m_cachedImage);
     CSSValue::traceAfterDispatch(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/css/CSSCursorImageValue.h b/third_party/WebKit/Source/core/css/CSSCursorImageValue.h
index 8144a8b..c383dd6 100644
--- a/third_party/WebKit/Source/core/css/CSSCursorImageValue.h
+++ b/third_party/WebKit/Source/core/css/CSSCursorImageValue.h
@@ -46,8 +46,9 @@ public:
     String customCSSText() const;
 
     bool updateIfSVGCursorIsUsed(Element*);
-    StyleImage* cachedImage(Document*, float deviceScaleFactor);
-    StyleImage* cachedOrPendingImage(float deviceScaleFactor);
+    bool isCachePending(float deviceScaleFactor) const;
+    StyleImage* cachedImage(float deviceScaleFactor);
+    StyleImage* cacheImage(Document*, float deviceScaleFactor);
 
 #if !ENABLE(OILPAN)
     void removeReferencedElement(SVGElement*);
@@ -68,8 +69,8 @@ private:
 
     bool m_hotSpotSpecified;
     IntPoint m_hotSpot;
-    RefPtrWillBeMember<StyleImage> m_image;
-    bool m_accessedImage;
+    bool m_isCachePending;
+    RefPtrWillBeMember<StyleImage> m_cachedImage;
 
 #if !ENABLE(OILPAN)
     HashSet<SVGElement*> m_referencedElements;
diff --git a/third_party/WebKit/Source/core/css/CSSImageSetValue.cpp b/third_party/WebKit/Source/core/css/CSSImageSetValue.cpp
index b9f8a5f..4c500c3 100644
--- a/third_party/WebKit/Source/core/css/CSSImageSetValue.cpp
+++ b/third_party/WebKit/Source/core/css/CSSImageSetValue.cpp
@@ -35,7 +35,6 @@
 #include "core/fetch/ResourceFetcher.h"
 #include "core/fetch/ResourceLoaderOptions.h"
 #include "core/style/StyleFetchedImageSet.h"
-#include "core/style/StylePendingImage.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/SecurityPolicy.h"
 #include "wtf/text/StringBuilder.h"
@@ -44,16 +43,16 @@ namespace blink {
 
 CSSImageSetValue::CSSImageSetValue()
     : CSSValueList(ImageSetClass, CommaSeparator)
-    , m_accessedBestFitImage(false)
-    , m_scaleFactor(1)
+    , m_isCachePending(true)
+    , m_cachedScaleFactor(1)
 {
 }
 
 CSSImageSetValue::~CSSImageSetValue()
 {
 #if !ENABLE(OILPAN)
-    if (m_imageSet && m_imageSet->isImageResourceSet())
-        toStyleFetchedImageSet(m_imageSet)->clearImageSetValue();
+    if (m_cachedImageSet && m_cachedImageSet->isImageResourceSet())
+        toStyleFetchedImageSet(m_cachedImageSet)->clearImageSetValue();
 #endif
 }
 
@@ -82,32 +81,41 @@ void CSSImageSetValue::fillImageSet()
     std::sort(m_imagesInSet.begin(), m_imagesInSet.end(), CSSImageSetValue::compareByScaleFactor);
 }
 
-CSSImageSetValue::ImageWithScale CSSImageSetValue::bestImageForScaleFactor()
+CSSImageSetValue::ImageWithScale CSSImageSetValue::bestImageForScaleFactor(float scaleFactor)
 {
     ImageWithScale image;
     size_t numberOfImages = m_imagesInSet.size();
     for (size_t i = 0; i < numberOfImages; ++i) {
         image = m_imagesInSet.at(i);
-        if (image.scaleFactor >= m_scaleFactor)
+        if (image.scaleFactor >= scaleFactor)
             return image;
     }
     return image;
 }
 
-StyleFetchedImageSet* CSSImageSetValue::cachedImageSet(Document* document, float deviceScaleFactor, const ResourceLoaderOptions& options)
+bool CSSImageSetValue::isCachePending(float deviceScaleFactor) const
 {
-    ASSERT(document);
+    return m_isCachePending || deviceScaleFactor != m_cachedScaleFactor;
+}
 
-    m_scaleFactor = deviceScaleFactor;
+StyleImage* CSSImageSetValue::cachedImageSet(float deviceScaleFactor)
+{
+    ASSERT(!isCachePending(deviceScaleFactor));
+    return m_cachedImageSet.get();
+}
+
+StyleFetchedImageSet* CSSImageSetValue::cacheImageSet(Document* document, float deviceScaleFactor, const ResourceLoaderOptions& options)
+{
+    ASSERT(document);
 
     if (!m_imagesInSet.size())
         fillImageSet();
 
-    if (!m_accessedBestFitImage) {
+    if (m_isCachePending || deviceScaleFactor != m_cachedScaleFactor) {
         // FIXME: In the future, we want to take much more than deviceScaleFactor into acount here.
         // All forms of scale should be included: Page::pageScaleFactor(), LocalFrame::pageZoomFactor(),
         // and any CSS transforms. https://bugs.webkit.org/show_bug.cgi?id=81698
-        ImageWithScale image = bestImageForScaleFactor();
+        ImageWithScale image = bestImageForScaleFactor(deviceScaleFactor);
         FetchRequest request(ResourceRequest(document->completeURL(image.imageURL)), FetchInitiatorTypeNames::css, options);
         request.mutableResourceRequest().setHTTPReferrer(image.referrer);
 
@@ -115,32 +123,18 @@ StyleFetchedImageSet* CSSImageSetValue::cachedImageSet(Document* document, float
             request.setCrossOriginAccessControl(document->securityOrigin(), options.allowCredentials, options.credentialsRequested);
 
         if (ResourcePtr<ImageResource> cachedImage = ImageResource::fetch(request, document->fetcher())) {
-            m_imageSet = StyleFetchedImageSet::create(cachedImage.get(), image.scaleFactor, this);
-            m_accessedBestFitImage = true;
+            m_cachedImageSet = StyleFetchedImageSet::create(cachedImage.get(), image.scaleFactor, this);
+            m_cachedScaleFactor = deviceScaleFactor;
+            m_isCachePending = false;
         }
     }
 
-    return (m_imageSet && m_imageSet->isImageResourceSet()) ? toStyleFetchedImageSet(m_imageSet) : nullptr;
+    return (m_cachedImageSet && m_cachedImageSet->isImageResourceSet()) ? toStyleFetchedImageSet(m_cachedImageSet) : nullptr;
 }
 
-StyleFetchedImageSet* CSSImageSetValue::cachedImageSet(Document* document, float deviceScaleFactor)
+StyleFetchedImageSet* CSSImageSetValue::cacheImageSet(Document* document, float deviceScaleFactor)
 {
-    return cachedImageSet(document, deviceScaleFactor, ResourceFetcher::defaultResourceOptions());
-}
-
-StyleImage* CSSImageSetValue::cachedOrPendingImageSet(float deviceScaleFactor)
-{
-    if (!m_imageSet) {
-        m_imageSet = StylePendingImage::create(this);
-    } else if (!m_imageSet->isPendingImage()) {
-        // If the deviceScaleFactor has changed, we may not have the best image loaded, so we have to re-assess.
-        if (deviceScaleFactor != m_scaleFactor) {
-            m_accessedBestFitImage = false;
-            m_imageSet = StylePendingImage::create(this);
-        }
-    }
-
-    return m_imageSet.get();
+    return cacheImageSet(document, deviceScaleFactor, ResourceFetcher::defaultResourceOptions());
 }
 
 String CSSImageSetValue::customCSSText() const
@@ -175,16 +169,16 @@ String CSSImageSetValue::customCSSText() const
 
 bool CSSImageSetValue::hasFailedOrCanceledSubresources() const
 {
-    if (!m_imageSet || !m_imageSet->isImageResourceSet())
+    if (!m_cachedImageSet || !m_cachedImageSet->isImageResourceSet())
         return false;
-    if (Resource* cachedResource = toStyleFetchedImageSet(m_imageSet)->cachedImage())
+    if (Resource* cachedResource = toStyleFetchedImageSet(m_cachedImageSet)->cachedImage())
         return cachedResource->loadFailedOrCanceled();
     return true;
 }
 
 DEFINE_TRACE_AFTER_DISPATCH(CSSImageSetValue)
 {
-    visitor->trace(m_imageSet);
+    visitor->trace(m_cachedImageSet);
     CSSValueList::traceAfterDispatch(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/css/CSSImageSetValue.h b/third_party/WebKit/Source/core/css/CSSImageSetValue.h
index c6b5c00..31d07bf 100644
--- a/third_party/WebKit/Source/core/css/CSSImageSetValue.h
+++ b/third_party/WebKit/Source/core/css/CSSImageSetValue.h
@@ -46,16 +46,13 @@ public:
     }
     ~CSSImageSetValue();
 
-    StyleFetchedImageSet* cachedImageSet(Document*, float deviceScaleFactor, const ResourceLoaderOptions&);
-    StyleFetchedImageSet* cachedImageSet(Document*, float deviceScaleFactor);
-
-    // Returns a StyleFetchedImageSet if the best fit image has been cached already, otherwise a StylePendingImage.
-    StyleImage* cachedOrPendingImageSet(float);
+    bool isCachePending(float deviceScaleFactor) const;
+    StyleImage* cachedImageSet(float deviceScaleFactor);
+    StyleFetchedImageSet* cacheImageSet(Document*, float deviceScaleFactor, const ResourceLoaderOptions&);
+    StyleFetchedImageSet* cacheImageSet(Document*, float deviceScaleFactor);
 
     String customCSSText() const;
 
-    bool isPending() const { return !m_accessedBestFitImage; }
-
     struct ImageWithScale {
         ALLOW_ONLY_INLINE_ALLOCATION();
         String imageURL;
@@ -70,7 +67,7 @@ public:
     DECLARE_TRACE_AFTER_DISPATCH();
 
 protected:
-    ImageWithScale bestImageForScaleFactor();
+    ImageWithScale bestImageForScaleFactor(float scaleFactor);
 
 private:
     CSSImageSetValue();
@@ -78,12 +75,9 @@ private:
     void fillImageSet();
     static inline bool compareByScaleFactor(ImageWithScale first, ImageWithScale second) { return first.scaleFactor < second.scaleFactor; }
 
-    RefPtrWillBeMember<StyleImage> m_imageSet;
-    bool m_accessedBestFitImage;
-
-    // This represents the scale factor that we used to find the best fit image. It does not necessarily
-    // correspond to the scale factor of the best fit image.
-    float m_scaleFactor;
+    bool m_isCachePending;
+    float m_cachedScaleFactor;
+    RefPtrWillBeMember<StyleImage> m_cachedImageSet;
 
     Vector<ImageWithScale> m_imagesInSet;
 };
diff --git a/third_party/WebKit/Source/core/css/CSSImageValue.cpp b/third_party/WebKit/Source/core/css/CSSImageValue.cpp
index dfcdb3f..aafac40 100644
--- a/third_party/WebKit/Source/core/css/CSSImageValue.cpp
+++ b/third_party/WebKit/Source/core/css/CSSImageValue.cpp
@@ -28,7 +28,6 @@
 #include "core/fetch/ImageResource.h"
 #include "core/loader/MixedContentChecker.h"
 #include "core/style/StyleFetchedImage.h"
-#include "core/style/StylePendingImage.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/SecurityPolicy.h"
 
@@ -38,8 +37,8 @@ CSSImageValue::CSSImageValue(const AtomicString& rawValue, const KURL& url, Styl
     : CSSValue(ImageClass)
     , m_relativeURL(rawValue)
     , m_absoluteURL(url.string())
-    , m_image(image)
-    , m_accessedImage(image)
+    , m_isCachePending(!image)
+    , m_cachedImage(image)
 {
 }
 
@@ -47,20 +46,12 @@ CSSImageValue::~CSSImageValue()
 {
 }
 
-StyleImage* CSSImageValue::cachedOrPendingImage()
-{
-    if (!m_image)
-        m_image = StylePendingImage::create(this);
-
-    return m_image.get();
-}
-
-StyleFetchedImage* CSSImageValue::cachedImage(Document* document, const ResourceLoaderOptions& options)
+StyleFetchedImage* CSSImageValue::cacheImage(Document* document, const ResourceLoaderOptions& options)
 {
     ASSERT(document);
 
-    if (!m_accessedImage) {
-        m_accessedImage = true;
+    if (m_isCachePending) {
+        m_isCachePending = false;
 
         FetchRequest request(ResourceRequest(m_absoluteURL), m_initiatorName.isEmpty() ? FetchInitiatorTypeNames::css : m_initiatorName, options);
         request.mutableResourceRequest().setHTTPReferrer(SecurityPolicy::generateReferrer(m_referrer.referrerPolicy, request.url(), m_referrer.referrer));
@@ -69,20 +60,20 @@ StyleFetchedImage* CSSImageValue::cachedImage(Document* document, const Resource
             request.setCrossOriginAccessControl(document->securityOrigin(), options.allowCredentials, options.credentialsRequested);
 
         if (ResourcePtr<ImageResource> cachedImage = ImageResource::fetch(request, document->fetcher()))
-            m_image = StyleFetchedImage::create(cachedImage.get(), document);
+            m_cachedImage = StyleFetchedImage::create(cachedImage.get(), document);
     }
 
-    return (m_image && m_image->isImageResource()) ? toStyleFetchedImage(m_image) : nullptr;
+    return (m_cachedImage && m_cachedImage->isImageResource()) ? toStyleFetchedImage(m_cachedImage) : nullptr;
 }
 
 void CSSImageValue::restoreCachedResourceIfNeeded(Document& document)
 {
-    if (!m_accessedImage || !m_image->isImageResource() || !document.fetcher())
+    if (m_isCachePending || !m_cachedImage->isImageResource() || !document.fetcher())
         return;
     if (document.fetcher()->cachedResource(KURL(ParsedURLString, m_absoluteURL)))
         return;
 
-    ImageResource* resource = m_image->cachedImage();
+    ImageResource* resource = m_cachedImage->cachedImage();
     if (!resource)
         return;
 
@@ -94,9 +85,9 @@ void CSSImageValue::restoreCachedResourceIfNeeded(Document& document)
 
 bool CSSImageValue::hasFailedOrCanceledSubresources() const
 {
-    if (!m_image || !m_image->isImageResource())
+    if (!m_cachedImage || !m_cachedImage->isImageResource())
         return false;
-    if (Resource* cachedResource = toStyleFetchedImage(m_image)->cachedImage())
+    if (Resource* cachedResource = toStyleFetchedImage(m_cachedImage)->cachedImage())
         return cachedResource->loadFailedOrCanceled();
     return true;
 }
@@ -114,12 +105,12 @@ String CSSImageValue::customCSSText() const
 
 bool CSSImageValue::knownToBeOpaque(const LayoutObject* layoutObject) const
 {
-    return m_image ? m_image->knownToBeOpaque(layoutObject) : false;
+    return m_cachedImage ? m_cachedImage->knownToBeOpaque(layoutObject) : false;
 }
 
 DEFINE_TRACE_AFTER_DISPATCH(CSSImageValue)
 {
-    visitor->trace(m_image);
+    visitor->trace(m_cachedImage);
     CSSValue::traceAfterDispatch(visitor);
 }
 
@@ -130,8 +121,8 @@ void CSSImageValue::reResolveURL(const Document& document)
     if (urlString == m_absoluteURL)
         return;
     m_absoluteURL = urlString;
-    m_accessedImage = false;
-    m_image.clear();
+    m_isCachePending = true;
+    m_cachedImage.clear();
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/css/CSSImageValue.h b/third_party/WebKit/Source/core/css/CSSImageValue.h
index 003d899..6497379 100644
--- a/third_party/WebKit/Source/core/css/CSSImageValue.h
+++ b/third_party/WebKit/Source/core/css/CSSImageValue.h
@@ -50,10 +50,10 @@ public:
     }
     ~CSSImageValue();
 
-    StyleFetchedImage* cachedImage(Document*, const ResourceLoaderOptions&);
-    StyleFetchedImage* cachedImage(Document* document) { return cachedImage(document, ResourceFetcher::defaultResourceOptions()); }
-    // Returns a StyleFetchedImage if the image is cached already, otherwise a StylePendingImage.
-    StyleImage* cachedOrPendingImage();
+    bool isCachePending() const { return m_isCachePending; }
+    StyleImage* cachedImage() { ASSERT(!isCachePending()); return m_cachedImage.get(); }
+    StyleFetchedImage* cacheImage(Document*, const ResourceLoaderOptions&);
+    StyleFetchedImage* cacheImage(Document* document) { return cacheImage(document, ResourceFetcher::defaultResourceOptions()); }
 
     const String& url() { return m_absoluteURL; }
 
@@ -72,7 +72,7 @@ public:
 
     PassRefPtrWillBeRawPtr<CSSImageValue> valueWithURLMadeAbsolute()
     {
-        return create(KURL(ParsedURLString, m_absoluteURL), m_image.get());
+        return create(KURL(ParsedURLString, m_absoluteURL), m_cachedImage.get());
     }
 
     void setInitiator(const AtomicString& name) { m_initiatorName = name; }
@@ -86,8 +86,8 @@ private:
     AtomicString m_relativeURL;
     AtomicString m_absoluteURL;
     Referrer m_referrer;
-    RefPtrWillBeMember<StyleImage> m_image;
-    bool m_accessedImage;
+    bool m_isCachePending;
+    RefPtrWillBeMember<StyleImage> m_cachedImage;
     AtomicString m_initiatorName;
 };
 
diff --git a/third_party/WebKit/Source/core/css/resolver/ElementStyleResources.cpp b/third_party/WebKit/Source/core/css/resolver/ElementStyleResources.cpp
index 4b6ba32..60be1fb 100644
--- a/third_party/WebKit/Source/core/css/resolver/ElementStyleResources.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/ElementStyleResources.cpp
@@ -57,7 +57,7 @@ PassRefPtrWillBeRawPtr<StyleImage> ElementStyleResources::styleImage(Document& d
 PassRefPtrWillBeRawPtr<StyleImage> ElementStyleResources::generatedOrPendingFromValue(CSSPropertyID property, CSSImageGeneratorValue* value)
 {
     if (value->isPending()) {
-        m_pendingImageProperties.set(property, value);
+        m_pendingImageProperties.add(property);
         return StylePendingImage::create(value);
     }
     return StyleGeneratedImage::create(value);
@@ -65,30 +65,30 @@ PassRefPtrWillBeRawPtr<StyleImage> ElementStyleResources::generatedOrPendingFrom
 
 PassRefPtrWillBeRawPtr<StyleImage> ElementStyleResources::setOrPendingFromValue(CSSPropertyID property, CSSImageSetValue* value)
 {
-    RefPtrWillBeRawPtr<StyleImage> image = value->cachedOrPendingImageSet(m_deviceScaleFactor);
-    if (image && image->isPendingImage())
-        m_pendingImageProperties.set(property, value);
-    return image.release();
+    if (value->isCachePending(m_deviceScaleFactor)) {
+        m_pendingImageProperties.add(property);
+        return StylePendingImage::create(value);
+    }
+    return value->cachedImageSet(m_deviceScaleFactor);
 }
 
 PassRefPtrWillBeRawPtr<StyleImage> ElementStyleResources::cachedOrPendingFromValue(Document& document, CSSPropertyID property, CSSImageValue* value)
 {
-    RefPtrWillBeRawPtr<StyleImage> image = value->cachedOrPendingImage();
-    if (image) {
-        if (image->isPendingImage())
-            m_pendingImageProperties.set(property, value);
-        else
-            value->restoreCachedResourceIfNeeded(document);
+    if (value->isCachePending()) {
+        m_pendingImageProperties.add(property);
+        return StylePendingImage::create(value);
     }
-    return image.release();
+    value->restoreCachedResourceIfNeeded(document);
+    return value->cachedImage();
 }
 
 PassRefPtrWillBeRawPtr<StyleImage> ElementStyleResources::cursorOrPendingFromValue(CSSPropertyID property, CSSCursorImageValue* value)
 {
-    RefPtrWillBeRawPtr<StyleImage> image = value->cachedOrPendingImage(m_deviceScaleFactor);
-    if (image && image->isPendingImage())
-        m_pendingImageProperties.set(property, value);
-    return image.release();
+    if (value->isCachePending(m_deviceScaleFactor)) {
+        m_pendingImageProperties.add(property);
+        return StylePendingImage::create(value);
+    }
+    return value->cachedImage(m_deviceScaleFactor);
 }
 
 void ElementStyleResources::clearPendingImageProperties()
diff --git a/third_party/WebKit/Source/core/css/resolver/ElementStyleResources.h b/third_party/WebKit/Source/core/css/resolver/ElementStyleResources.h
index ce8a6c1d..61c1eae 100644
--- a/third_party/WebKit/Source/core/css/resolver/ElementStyleResources.h
+++ b/third_party/WebKit/Source/core/css/resolver/ElementStyleResources.h
@@ -41,8 +41,8 @@ class FilterOperation;
 class StyleImage;
 class TextLinkColors;
 
+using PendingImagePropertySet = HashSet<CSSPropertyID>;
 using PendingSVGDocumentMap = WillBeHeapHashMap<RawPtrWillBeMember<FilterOperation>, RefPtrWillBeMember<CSSSVGDocumentValue>>;
-using PendingImagePropertyMap = WillBeHeapHashMap<CSSPropertyID, RefPtrWillBeMember<CSSValue>>;
 
 // Holds information about resources, requested by stylesheets.
 // Lifetime: per-element style resolve.
@@ -59,7 +59,7 @@ public:
     PassRefPtrWillBeRawPtr<StyleImage> setOrPendingFromValue(CSSPropertyID, CSSImageSetValue*);
     PassRefPtrWillBeRawPtr<StyleImage> cursorOrPendingFromValue(CSSPropertyID, CSSCursorImageValue*);
 
-    const PendingImagePropertyMap& pendingImageProperties() const { return m_pendingImageProperties; }
+    const PendingImagePropertySet& pendingImageProperties() const { return m_pendingImageProperties; }
     const PendingSVGDocumentMap& pendingSVGDocuments() const { return m_pendingSVGDocuments; }
 
     void clearPendingImageProperties();
@@ -71,7 +71,7 @@ public:
     void addPendingSVGDocument(FilterOperation*, CSSSVGDocumentValue*);
 
 private:
-    PendingImagePropertyMap m_pendingImageProperties;
+    PendingImagePropertySet m_pendingImageProperties;
     PendingSVGDocumentMap m_pendingSVGDocuments;
     float m_deviceScaleFactor;
 };
diff --git a/third_party/WebKit/Source/core/css/resolver/StyleResourceLoader.cpp b/third_party/WebKit/Source/core/css/resolver/StyleResourceLoader.cpp
index 7c780c4..313bbb2 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleResourceLoader.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/StyleResourceLoader.cpp
@@ -30,14 +30,14 @@
 #include "core/css/resolver/ElementStyleResources.h"
 #include "core/dom/Document.h"
 #include "core/fetch/ResourceFetcher.h"
+#include "core/layout/svg/ReferenceFilterBuilder.h"
+#include "core/style/ComputedStyle.h"
 #include "core/style/ContentData.h"
 #include "core/style/FillLayer.h"
-#include "core/style/ComputedStyle.h"
 #include "core/style/StyleFetchedImage.h"
 #include "core/style/StyleFetchedImageSet.h"
 #include "core/style/StyleGeneratedImage.h"
 #include "core/style/StylePendingImage.h"
-#include "core/layout/svg/ReferenceFilterBuilder.h"
 
 namespace blink {
 
@@ -80,20 +80,18 @@ void StyleResourceLoader::loadPendingSVGDocuments(ComputedStyle* computedStyle,
 static PassRefPtrWillBeRawPtr<StyleImage> doLoadPendingImage(Document* document, StylePendingImage* pendingImage, float deviceScaleFactor, const ResourceLoaderOptions& options)
 {
     if (CSSImageValue* imageValue = pendingImage->cssImageValue())
-        return imageValue->cachedImage(document, options);
+        return imageValue->cacheImage(document, options);
 
-    if (CSSImageGeneratorValue* imageGeneratorValue
-        = pendingImage->cssImageGeneratorValue()) {
+    if (CSSImageGeneratorValue* imageGeneratorValue = pendingImage->cssImageGeneratorValue()) {
         imageGeneratorValue->loadSubimages(document);
         return StyleGeneratedImage::create(imageGeneratorValue);
     }
 
-    if (CSSCursorImageValue* cursorImageValue
-        = pendingImage->cssCursorImageValue())
-        return cursorImageValue->cachedImage(document, deviceScaleFactor);
+    if (CSSCursorImageValue* cursorImageValue = pendingImage->cssCursorImageValue())
+        return cursorImageValue->cacheImage(document, deviceScaleFactor);
 
     if (CSSImageSetValue* imageSetValue = pendingImage->cssImageSetValue())
-        return imageSetValue->cachedImageSet(document, deviceScaleFactor, options);
+        return imageSetValue->cacheImageSet(document, deviceScaleFactor, options);
 
     return nullptr;
 }
@@ -125,11 +123,8 @@ void StyleResourceLoader::loadPendingImages(ComputedStyle* style, ElementStyleRe
     if (elementStyleResources.pendingImageProperties().isEmpty())
         return;
 
-    PendingImagePropertyMap::const_iterator::Keys end = elementStyleResources.pendingImageProperties().end().keys();
-    for (PendingImagePropertyMap::const_iterator::Keys it = elementStyleResources.pendingImageProperties().begin().keys(); it != end; ++it) {
-        CSSPropertyID currentProperty = *it;
-
-        switch (currentProperty) {
+    for (CSSPropertyID property : elementStyleResources.pendingImageProperties()) {
+        switch (property) {
         case CSSPropertyBackgroundImage: {
             for (FillLayer* backgroundLayer = &style->accessBackgroundLayers(); backgroundLayer; backgroundLayer = backgroundLayer->next()) {
                 if (backgroundLayer->image() && backgroundLayer->image()->isPendingImage())
diff --git a/third_party/WebKit/Source/core/page/PageSerializer.cpp b/third_party/WebKit/Source/core/page/PageSerializer.cpp
index 96d4a42..582f021 100644
--- a/third_party/WebKit/Source/core/page/PageSerializer.cpp
+++ b/third_party/WebKit/Source/core/page/PageSerializer.cpp
@@ -530,8 +530,9 @@ void PageSerializer::retrieveResourcesForCSSValue(CSSValue* cssValue, Document&
 {
     if (cssValue->isImageValue()) {
         CSSImageValue* imageValue = toCSSImageValue(cssValue);
-        StyleImage* styleImage = imageValue->cachedOrPendingImage();
-        // Non cached-images are just place-holders and do not contain data.
+        if (imageValue->isCachePending())
+            return;
+        StyleImage* styleImage = imageValue->cachedImage();
         if (!styleImage || !styleImage->isImageResource())
             return;
 
diff --git a/third_party/WebKit/Source/core/style/StylePendingImage.h b/third_party/WebKit/Source/core/style/StylePendingImage.h
index 79e5894..7d48c81 100644
--- a/third_party/WebKit/Source/core/style/StylePendingImage.h
+++ b/third_party/WebKit/Source/core/style/StylePendingImage.h
@@ -46,7 +46,7 @@ public:
         return adoptRefWillBeNoop(new StylePendingImage(value));
     }
 
-    WrappedImagePtr data() const override { return m_value; }
+    WrappedImagePtr data() const override { return m_value.get(); }
 
     PassRefPtrWillBeRawPtr<CSSValue> cssValue() const override { return m_value; }
 
@@ -56,10 +56,10 @@ public:
         return nullptr;
     }
 
-    CSSImageValue* cssImageValue() const { return m_value->isImageValue() ? toCSSImageValue(m_value) : 0; }
-    CSSImageGeneratorValue* cssImageGeneratorValue() const { return m_value->isImageGeneratorValue() ? toCSSImageGeneratorValue(m_value) : 0; }
-    CSSCursorImageValue* cssCursorImageValue() const { return m_value->isCursorImageValue() ? toCSSCursorImageValue(m_value) : 0; }
-    CSSImageSetValue* cssImageSetValue() const { return m_value->isImageSetValue() ? toCSSImageSetValue(m_value) : 0; }
+    CSSImageValue* cssImageValue() const { return m_value->isImageValue() ? toCSSImageValue(m_value.get()) : 0; }
+    CSSImageGeneratorValue* cssImageGeneratorValue() const { return m_value->isImageGeneratorValue() ? toCSSImageGeneratorValue(m_value.get()) : 0; }
+    CSSCursorImageValue* cssCursorImageValue() const { return m_value->isCursorImageValue() ? toCSSCursorImageValue(m_value.get()) : 0; }
+    CSSImageSetValue* cssImageSetValue() const { return m_value->isImageSetValue() ? toCSSImageSetValue(m_value.get()) : 0; }
 
     LayoutSize imageSize(const LayoutObject*, float /*multiplier*/) const override { return LayoutSize(); }
     bool imageHasRelativeWidth() const override { return false; }
@@ -89,7 +89,7 @@ private:
         m_isPendingImage = true;
     }
 
-    RawPtrWillBeMember<CSSValue> m_value; // Not retained; it owns us.
+    RefPtrWillBeMember<CSSValue> m_value;
 };
 
 DEFINE_STYLE_IMAGE_TYPE_CASTS(StylePendingImage, isPendingImage());