diff --git a/content/base/src/nsImageLoadingContent.h b/content/base/src/nsImageLoadingContent.h index a2f2fbebc8a..570a642eb6d 100644 --- a/content/base/src/nsImageLoadingContent.h +++ b/content/base/src/nsImageLoadingContent.h @@ -225,6 +225,13 @@ private: void CancelImageRequests(nsresult aReason, PRBool aEvenIfSizeAvailable, PRInt16 aNewImageStatus); + /** + * Method to fire an event once we know what's going on with the image load. + * + * @param aEventType "load" or "error" depending on how things went + */ + nsresult FireEvent(const nsAString& aEventType); +protected: /** * Method to create an nsIURI object from the given string (will * handle getting the right charset, base, etc). You MUST pass in a @@ -237,13 +244,6 @@ private: nsresult StringToURI(const nsAString& aSpec, nsIDocument* aDocument, nsIURI** aURI); - /** - * Method to fire an event once we know what's going on with the image load. - * - * @param aEventType "load" or "error" depending on how things went - */ - nsresult FireEvent(const nsAString& aEventType); -protected: void CreateStaticImageClone(nsImageLoadingContent* aDest) const; /** diff --git a/content/svg/content/src/crashtests/613899-1.svg b/content/svg/content/src/crashtests/613899-1.svg new file mode 100644 index 00000000000..581537703e1 --- /dev/null +++ b/content/svg/content/src/crashtests/613899-1.svg @@ -0,0 +1,9 @@ + + + + + + + diff --git a/content/svg/content/src/crashtests/613899-2.svg b/content/svg/content/src/crashtests/613899-2.svg new file mode 100644 index 00000000000..f88be69394c --- /dev/null +++ b/content/svg/content/src/crashtests/613899-2.svg @@ -0,0 +1,7 @@ + + + + + + diff --git a/content/svg/content/src/crashtests/crashtests.list b/content/svg/content/src/crashtests/crashtests.list index 8a305ef6bc8..264542c6396 100644 --- a/content/svg/content/src/crashtests/crashtests.list +++ b/content/svg/content/src/crashtests/crashtests.list @@ -55,4 +55,6 @@ load 595608-1.svg load 601251-1.html load 601406-1.svg load 603145-1.svg -load zero-size-image.svg \ No newline at end of file +load 613899-1.svg +load 613899-2.svg +load zero-size-image.svg diff --git a/content/svg/content/src/nsSVGFilters.cpp b/content/svg/content/src/nsSVGFilters.cpp index a7094dd6c1c..3d83aca4e14 100644 --- a/content/svg/content/src/nsSVGFilters.cpp +++ b/content/svg/content/src/nsSVGFilters.cpp @@ -5405,6 +5405,19 @@ nsSVGFEImageElement::LoadSVGImage(PRBool aForce, PRBool aNotify) if (baseURI && !href.IsEmpty()) NS_MakeAbsoluteURI(href, href, baseURI); + // Make sure we don't get in a recursive death-spiral + nsIDocument* doc = GetOurDocument(); + if (doc) { + nsCOMPtr hrefAsURI; + if (NS_SUCCEEDED(StringToURI(href, doc, getter_AddRefs(hrefAsURI)))) { + PRBool isEqual; + if (NS_SUCCEEDED(hrefAsURI->Equals(baseURI, &isEqual)) && isEqual) { + // Image URI matches our URI exactly! Bail out. + return NS_OK; + } + } + } + return LoadImage(href, aForce, aNotify); }