From bce91931d5e2b6bfb36d14f67a7021a1218cb259 Mon Sep 17 00:00:00 2001
From: Fredrik Söderquist <[email protected]>
Date: Thu, 08 Oct 2026 03:25:13 -0700
Subject: [PATCH] [M155] Fix observer iteration in SVGResourceDocumentContent

Original change's description:
> Fix observer iteration in SVGResourceDocumentContent
>
> The SVGResourceDocumentObserver::ResourceNotifyFinished() callback can
> cause new observers to be added. Iterate in a copy.
>
> Fixed: 570047270
> Change-Id: Idd45163296244443e3ce7d6b292e78fc39aaee83
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8519167
> Commit-Queue: Philip Rogers <[email protected]>
> Reviewed-by: Philip Rogers <[email protected]>
> Auto-Submit: Fredrik Söderquist <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1712579}

(cherry picked from commit 035234e0b8a26edd30bcc93f81efd642d099f720)

Bug: 571383091,570047270
Change-Id: Idd45163296244443e3ce7d6b292e78fc39aaee83
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8538327
Bot-Commit: [email protected] <[email protected]>
Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com <chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: [email protected] <[email protected]>
Cr-Commit-Position: refs/branch-heads/8059@{#1030}
Cr-Branched-From: 199ac2cd7ab289e11c2236bd2cede848781213da-refs/heads/main@{#1697595}
---
diff --git a/third_party/blink/renderer/core/svg/svg_resource_document_content.cc b/third_party/blink/renderer/core/svg/svg_resource_document_content.cc
index 615f636..8ad1a6a 100644
--- a/third_party/blink/renderer/core/svg/svg_resource_document_content.cc
+++ b/third_party/blink/renderer/core/svg/svg_resource_document_content.cc
@@ -211,7 +211,8 @@
 }
 
 void SVGResourceDocumentContent::NotifyObservers() {
-  for (auto& observer : observers_) {
+  HeapVector<Member<SVGResourceDocumentObserver>> observer_list(observers_);
+  for (auto& observer : observer_list) {
     observer->ResourceNotifyFinished(this);
   }
 }
@@ -250,7 +251,8 @@
   if (inhibit_content_change_) {
     return;
   }
-  for (auto& observer : observers_) {
+  HeapVector<Member<SVGResourceDocumentObserver>> observer_list(observers_);
+  for (auto& observer : observer_list) {
     observer->ResourceContentChanged(this);
   }
 }