Bug 613899: If SVG <feImage> element points to our current document's exact URL, keep it from loading that image, to avoid a recursive death-spiral. r=longsonr a=roc

content/base/src/nsImageLoadingContent.h

@@ -225,6 +225,13 @@ private:
   void CancelImageRequests(nsresult aReason, PRBool aEvenIfSizeAvailable,
                            PRInt16 aNewImageStatus);
 
+  /**
+   * Method to fire an event once we know what's going on with the image load.
+   *
+   * @param aEventType "load" or "error" depending on how things went
+   */
+  nsresult FireEvent(const nsAString& aEventType);
+protected:
   /**
    * Method to create an nsIURI object from the given string (will
    * handle getting the right charset, base, etc).  You MUST pass in a
@@ -237,13 +244,6 @@ private:
   nsresult StringToURI(const nsAString& aSpec, nsIDocument* aDocument,
                        nsIURI** aURI);
 
-  /**
-   * Method to fire an event once we know what's going on with the image load.
-   *
-   * @param aEventType "load" or "error" depending on how things went
-   */
-  nsresult FireEvent(const nsAString& aEventType);
-protected:
   void CreateStaticImageClone(nsImageLoadingContent* aDest) const;
 
   /**

content/svg/content/src/crashtests/613899-1.svg

@@ -0,0 +1,9 @@
+<svg xmlns='http://www.w3.org/2000/svg'
+     xmlns:xlink='http://www.w3.org/1999/xlink'
+     width='16' height='16'>
+  <image id='i' xlink:href='a.png' width='16' height='16'/>
+	<filter id="f" x="0%" y="0%" width="100%" height="100%">
+	  <feImage xlink:href="#image1" />
+	</filter>
+  <rect filter="url(#f)" x="0" y="0" width="16" height="16"/>
+</svg>

content/svg/content/src/crashtests/613899-2.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+  <set/>
+  <filter id="disp">
+    <feImage xlink:href="#THIS_SVG_FILE_AS_AN_IMAGE"/>
+  </filter>
+</svg>

content/svg/content/src/crashtests/crashtests.list

@@ -55,4 +55,6 @@ load 595608-1.svg
 load 601251-1.html
 load 601406-1.svg
 load 603145-1.svg
-load zero-size-image.svg
+load 613899-1.svg
+load 613899-2.svg
+load zero-size-image.svg

content/svg/content/src/nsSVGFilters.cpp

@@ -5405,6 +5405,19 @@ nsSVGFEImageElement::LoadSVGImage(PRBool aForce, PRBool aNotify)
   if (baseURI && !href.IsEmpty())
     NS_MakeAbsoluteURI(href, href, baseURI);
 
+  // Make sure we don't get in a recursive death-spiral
+  nsIDocument* doc = GetOurDocument();
+  if (doc) {
+    nsCOMPtr<nsIURI> hrefAsURI;
+    if (NS_SUCCEEDED(StringToURI(href, doc, getter_AddRefs(hrefAsURI)))) {
+      PRBool isEqual;
+      if (NS_SUCCEEDED(hrefAsURI->Equals(baseURI, &isEqual)) && isEqual) {
+        // Image URI matches our URI exactly! Bail out.
+        return NS_OK;
+      }
+    }
+  }
+
   return LoadImage(href, aForce, aNotify);
 }