Code: void SVGImage::setContainerSize(const IntSize& size)
{
    if (!m_page || !usesContainerSize())
        return;

    LocalFrame* frame = m_page->mainFrame();
     SVGSVGElement* rootElement = toSVGDocument(frame->document())->rootElement();
     if (!rootElement)
         return;
    RenderSVGRoot* renderer = toRenderSVGRoot(rootElement->renderer());
    if (!renderer)
        return;
 
     FrameView* view = frameView();
     view->resize(this->containerSize());
 
     renderer->setContainerSize(size);
 }

Vulnerability Type: DoS 
CWE ID: CWE-399
Summary: Use-after-free vulnerability in the SVGImage::setContainerSize function in core/svg/graphics/SVGImage.cpp in the SVG implementation in Blink, as used in Google Chrome before 33.0.1750.146, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the resizing of a view.
Commit Message: Fix crash when resizing a view destroys the render tree

This is a simple fix for not holding a renderer across FrameView
resizes. Calling view->resize() can destroy renderers so this patch
updates SVGImage::setContainerSize to query the renderer after the
resize is complete. A similar issue does not exist for the dom tree
which is not destroyed.

BUG=344492

Review URL: https://codereview.chromium.org/178043006

git-svn-id: svn://svn.chromium.org/blink/trunk@168113 bbb929c8-8fbe-4397-9dbb-9b2b20218538