Hiding then showing an <object> of type image makes the underlaying image disappear

[Said Abou-Hallawa]

Created attachment 339339 [details]
test case

Open the attached test case.

The test case contains an <object> element of type image. The script hides the <object> then it shows the <object> again.

Result: An outline rectangle is drawn.
Expected: The underlaying image of the <object> element is shown.

The reason for this bug is the following:
-- The ImageLoader and the <object> element stay alive but the RenderImage is destroyed when the element is made hidden. 
-- When the <object> element is shown again, a new RenderImage is created. 
-- ImageLoader::updateFromElement() does not call updateRenderer() or dispatchPendingBeforeLoadEvent() because the image is already loaded i.e. (newImage == oldImage).
-- Therefore we do not set the CachedImage of the RenderImageResource of the RenderImage.
-- When RenderImage::paintReplaced() is called after the image is made visible again, it does not find a CachedImage for its RenderImageResource.
-- So RenderImage::paintReplaced() draws an outline rectangle instead.

[Said Abou-Hallawa]

<rdar://problem/39055630>

[Said Abou-Hallawa]

Created attachment 339343 [details]
Patch

[Said Abou-Hallawa]

Created attachment 339361 [details]
Patch

[youenn fablet]

Comment on attachment 339361 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=339361&action=review

> Source/WebCore/html/HTMLPlugInImageElement.cpp:235
> +        RenderImageResource& renderImageResource = renderImage.imageResource();

auto&, maybe no need for renderImage variable also.

[Said Abou-Hallawa]

Created attachment 339364 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 339364 [details]
Patch

Clearing flags on attachment: 339364

Committed r231292: <https://trac.webkit.org/changeset/231292>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.