Bug 232972

Created attachment 443878 [details] test case Open the attached test case. Result: WebKit crashes because of infinite recursion. This happens because of r285481. Before this change, we were creating the ImageBuffer of the referenced SVGElement for the FEImage through RenderSVGResourceFilter::postApplyResource(). Now we we create this ImageBuffer through RenderSVGResourceFilter::applyResource(). The difference is at the end of RenderSVGResourceFilter::applyResource() we add entry to m_rendererFilterDataMap m_rendererFilterDataMap.set(&renderer, WTFMove(filterData)); This will detect the cycle if we try to build the same filter while we are running RenderSVGResourceFilter::postApplyResource(). if (m_rendererFilterDataMap.contains(&renderer)) { FilterData* filterData = m_rendererFilterDataMap.get(&renderer); if (filterData->state == FilterData::PaintingSource || filterData->state == FilterData::Applying) filterData->state = FilterData::CycleDetected; return false; // Already built, or we're in a cycle, or we're marked for removal. Regardless, just do nothing more now. } But this will not help detect it before we add the entry to the m_rendererFilterDataMap.