diff --git a/content/base/src/nsImageLoadingContent.h b/content/base/src/nsImageLoadingContent.h
index a2f2fbebc8a..570a642eb6d 100644
--- a/content/base/src/nsImageLoadingContent.h
+++ b/content/base/src/nsImageLoadingContent.h
@@ -225,6 +225,13 @@ private:
void CancelImageRequests(nsresult aReason, PRBool aEvenIfSizeAvailable,
PRInt16 aNewImageStatus);
+ /**
+ * Method to fire an event once we know what's going on with the image load.
+ *
+ * @param aEventType "load" or "error" depending on how things went
+ */
+ nsresult FireEvent(const nsAString& aEventType);
+protected:
/**
* Method to create an nsIURI object from the given string (will
* handle getting the right charset, base, etc). You MUST pass in a
@@ -237,13 +244,6 @@ private:
nsresult StringToURI(const nsAString& aSpec, nsIDocument* aDocument,
nsIURI** aURI);
- /**
- * Method to fire an event once we know what's going on with the image load.
- *
- * @param aEventType "load" or "error" depending on how things went
- */
- nsresult FireEvent(const nsAString& aEventType);
-protected:
void CreateStaticImageClone(nsImageLoadingContent* aDest) const;
/**
diff --git a/content/svg/content/src/crashtests/613899-1.svg b/content/svg/content/src/crashtests/613899-1.svg
new file mode 100644
index 00000000000..581537703e1
--- /dev/null
+++ b/content/svg/content/src/crashtests/613899-1.svg
@@ -0,0 +1,9 @@
+
diff --git a/content/svg/content/src/crashtests/613899-2.svg b/content/svg/content/src/crashtests/613899-2.svg
new file mode 100644
index 00000000000..f88be69394c
--- /dev/null
+++ b/content/svg/content/src/crashtests/613899-2.svg
@@ -0,0 +1,7 @@
+
diff --git a/content/svg/content/src/crashtests/crashtests.list b/content/svg/content/src/crashtests/crashtests.list
index 8a305ef6bc8..264542c6396 100644
--- a/content/svg/content/src/crashtests/crashtests.list
+++ b/content/svg/content/src/crashtests/crashtests.list
@@ -55,4 +55,6 @@ load 595608-1.svg
load 601251-1.html
load 601406-1.svg
load 603145-1.svg
-load zero-size-image.svg
\ No newline at end of file
+load 613899-1.svg
+load 613899-2.svg
+load zero-size-image.svg
diff --git a/content/svg/content/src/nsSVGFilters.cpp b/content/svg/content/src/nsSVGFilters.cpp
index a7094dd6c1c..3d83aca4e14 100644
--- a/content/svg/content/src/nsSVGFilters.cpp
+++ b/content/svg/content/src/nsSVGFilters.cpp
@@ -5405,6 +5405,19 @@ nsSVGFEImageElement::LoadSVGImage(PRBool aForce, PRBool aNotify)
if (baseURI && !href.IsEmpty())
NS_MakeAbsoluteURI(href, href, baseURI);
+ // Make sure we don't get in a recursive death-spiral
+ nsIDocument* doc = GetOurDocument();
+ if (doc) {
+ nsCOMPtr hrefAsURI;
+ if (NS_SUCCEEDED(StringToURI(href, doc, getter_AddRefs(hrefAsURI)))) {
+ PRBool isEqual;
+ if (NS_SUCCEEDED(hrefAsURI->Equals(baseURI, &isEqual)) && isEqual) {
+ // Image URI matches our URI exactly! Bail out.
+ return NS_OK;
+ }
+ }
+ }
+
return LoadImage(href, aForce, aNotify);
}