Bug 1383791 - Download an SVG resource only if the mask URL consists of a fragment. draft
authorcku <cku@mozilla.com>
Wed, 19 Jul 2017 19:45:34 +0800
changeset 614915 5a10a14bf1a6f281450fe6830bc5eb2ccd9f82f3
parent 614808 dcfb58fcb6dd8f6474eed6520ba6272dedded393
child 639009 ce6870f951bb455c61fde6714e7b1d12d69bc5b9
push id70171
push userbmo:cku@mozilla.com
push dateTue, 25 Jul 2017 06:08:54 +0000
bugs1383791
milestone56.0a1
Bug 1383791 - Download an SVG resource only if the mask URL consists of a fragment. MozReview-Commit-ID: OT6ipv3qSj
layout/svg/nsSVGEffects.cpp
--- a/layout/svg/nsSVGEffects.cpp
+++ b/layout/svg/nsSVGEffects.cpp
@@ -392,18 +392,30 @@ nsSVGMarkerProperty::DoUpdate()
 NS_IMPL_ISUPPORTS(nsSVGMaskProperty, nsISupports)
 
 nsSVGMaskProperty::nsSVGMaskProperty(nsIFrame* aFrame)
 {
   const nsStyleSVGReset *svgReset = aFrame->StyleSVGReset();
 
   for (uint32_t i = 0; i < svgReset->mMask.mImageCount; i++) {
     nsCOMPtr<nsIURI> maskUri = nsSVGEffects::GetMaskURI(aFrame, i);
-    nsSVGPaintingProperty* prop = new nsSVGPaintingProperty(maskUri, aFrame,
-                                                            false);
+    bool hasRef = false;
+    if (maskUri) {
+      maskUri->GetHasRef(&hasRef);
+    }
+
+    // Accrording to maskUri, nsSVGPaintingProperty's ctor may trigger an
+    // external SVG resource download, so we should pass maskUri in only if
+    // maskUri has a chance pointing to an SVG mask resource.
+    //
+    // And, an URL may refer to an SVG mask resource if it consists of
+    // a fragment.
+    nsSVGPaintingProperty* prop =
+      new nsSVGPaintingProperty(hasRef ? maskUri.get() : nullptr,
+                                aFrame, false);
     mProperties.AppendElement(prop);
   }
 }
 
 bool
 nsSVGTextPathProperty::TargetIsValid()
 {
   Element* target = GetTarget();