From 1d69cc5a02596c6904644f57dfd2c45efc04cf3e Mon Sep 17 00:00:00 2001
From: Stefan Zager <[email protected]>
Date: Tue, 06 Oct 2026 09:11:05 -0700
Subject: [PATCH] Fix stale iterators during svg resource cycle check

Fixed: 569038297
Change-Id: I62c94483506a992005d71673eff044202b9a784c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8516494
Reviewed-by: Fredrik Söderquist <[email protected]>
Commit-Queue: Stefan Zager <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1712397}
---
diff --git a/third_party/blink/renderer/core/svg/svg_resource.cc b/third_party/blink/renderer/core/svg/svg_resource.cc
index 8bca462..5b6a716 100644
--- a/third_party/blink/renderer/core/svg/svg_resource.cc
+++ b/third_party/blink/renderer/core/svg/svg_resource.cc
@@ -181,23 +181,28 @@
   auto* container = ResourceContainerForCycleCheck();
   if (!container)
     return false;
-  ClientEntry& entry = it->value;
-  switch (entry.cached_cycle_check) {
+  switch (it->value.cached_cycle_check) {
     case kNeedCheck: {
-      entry.cached_cycle_check = kPerformingCheck;
+      it->value.cached_cycle_check = kPerformingCheck;
       bool has_cycle = container->FindCycle();
-      DCHECK_EQ(entry.cached_cycle_check, kPerformingCheck);
+      // FindCycle() can modify clients_ and invalidate the iterator
+      it = clients_.find(&client);
+      CHECK(it != clients_.end());
+      DCHECK_EQ(it->value.cached_cycle_check, kPerformingCheck);
       // Update our cached state based on the result of FindCycle(), but don't
       // signal a cycle since ResourceContainer() will consider the resource
       // invalid if one is present, thus we break the cycle at this resource.
-      entry.cached_cycle_check = has_cycle ? kHasCycle : kNoCycle;
+      it->value.cached_cycle_check = has_cycle ? kHasCycle : kNoCycle;
       return false;
     }
     case kNoCycle: {
-      entry.cached_cycle_check = kPerformingCheck;
+      it->value.cached_cycle_check = kPerformingCheck;
       bool has_cycle = container->FindCycle();
-      DCHECK_EQ(entry.cached_cycle_check, kPerformingCheck);
-      entry.cached_cycle_check = kNoCycle;
+      // FindCycle() can modify clients_ and invalidate the iterator
+      it = clients_.find(&client);
+      CHECK(it != clients_.end());
+      DCHECK_EQ(it->value.cached_cycle_check, kPerformingCheck);
+      it->value.cached_cycle_check = kNoCycle;
       return has_cycle;
     }
     case kPerformingCheck: