To fix https://bugs.chromium.org/p/chromium/issues/detail?id=747672, I added an IsCacheValidator() check to LayoutImage::EmbeddedReplacedContent, which causes us to ignore the replaced content if it is an SVGImage in the process of being revalidated. This is hacky, temporary fix. Opening this bug to track fixing it the right way.

From https://chromium-review.googlesource.com/c/chromium/src/+/634131#message-cc383973599a601c024491ecb589a181423258e5

"
1. Start revalidation with SVGImage from MemoryCache
2. Layout happens while waiting for revalidation response. LayoutImage is laid out, and its LayoutReplaced superclass inspects the SVGImage that is being revalidated. It looks like a 100% valid SVGImage, has a size, etc. Intrinsic size is updated (see LayoutReplaced::ComputeIntrinsicSizingInfoForReplacedContent), but for reasons that I don't fully understand, this then gets clamped to 0x0 by LayoutBox::ComputeReplacedLogical{Height,Width}RespectingMinMax{Height,Width}
3. Revalidation finishes. The intrinsic style doesn't change, but the computed height/width need update. They don't get updated because SetNeedsLayoutAndFullPaintInvalidation() isn't called.

Using IsCacheValidator() here probably isn't the best solution, but it gets us close to the way things used to work, appears to work reliably, prevents us from depending on data that might be invalid, and I don't think it should trigger too many spurious layouts (my primary fear with a more invasive change right before a branch).
"