Bug 1383791 - Download an SVG resource only if the mask URL consists of a fragment.
MozReview-Commit-ID: OT6ipv3qSj
--- a/layout/svg/nsSVGEffects.cpp
+++ b/layout/svg/nsSVGEffects.cpp
@@ -392,18 +392,30 @@ nsSVGMarkerProperty::DoUpdate()
NS_IMPL_ISUPPORTS(nsSVGMaskProperty, nsISupports)
nsSVGMaskProperty::nsSVGMaskProperty(nsIFrame* aFrame)
{
const nsStyleSVGReset *svgReset = aFrame->StyleSVGReset();
for (uint32_t i = 0; i < svgReset->mMask.mImageCount; i++) {
nsCOMPtr<nsIURI> maskUri = nsSVGEffects::GetMaskURI(aFrame, i);
- nsSVGPaintingProperty* prop = new nsSVGPaintingProperty(maskUri, aFrame,
- false);
+ bool hasRef = false;
+ if (maskUri) {
+ maskUri->GetHasRef(&hasRef);
+ }
+
+ // Accrording to maskUri, nsSVGPaintingProperty's ctor may trigger an
+ // external SVG resource download, so we should pass maskUri in only if
+ // maskUri has a chance pointing to an SVG mask resource.
+ //
+ // And, an URL may refer to an SVG mask resource if it consists of
+ // a fragment.
+ nsSVGPaintingProperty* prop =
+ new nsSVGPaintingProperty(hasRef ? maskUri.get() : nullptr,
+ aFrame, false);
mProperties.AppendElement(prop);
}
}
bool
nsSVGTextPathProperty::TargetIsValid()
{
Element* target = GetTarget();