Fix infinite recursion in computePreferredLogicalWidths.

Source/core/rendering/RenderReplaced.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011-2012. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 207 matching lines @@
 static inline RenderBlock* firstContainingBlockWithLogicalWidth(const RenderReplaced* replaced)
 {
     // We have to lookup the containing block, which has an explicit width, which must not be equal to our direct containing block.
     // If the embedded document appears _after_ we performed the initial layout, our intrinsic size is 300x150. If our containing
     // block doesn't provide an explicit width, it's set to the 300 default, coming from the initial layout run.
     RenderBlock* containingBlock = replaced->containingBlock();
     if (!containingBlock)
         return 0;
 
     for (; !containingBlock->isRenderView() && !containingBlock->isBody(); containingBlock = containingBlock->containingBlock()) {
-        if (containingBlock->style()->logicalWidth().isSpecified())
+        if (containingBlock->style()->logicalWidth().isSpecified()
+            && containingBlock->style()->logicalMinWidth().isSpecified()
+            && (containingBlock->style()->logicalMaxWidth().isSpecified() || containingBlock->style()->logicalMaxWidth().isUndefined()))
             return containingBlock;
     }
 
     return 0;
 }
 
 bool RenderReplaced::hasReplacedLogicalWidth() const
 {
     if (style()->logicalWidth().isSpecified())
         return true;
@@ skipping 172 matching lines @@
                 return computeReplacedLogicalWidthRespectingMinMaxWidth(roundToInt(round(logicalHeight * intrinsicRatio)), shouldComputePreferred);
             }
 
             // If 'height' and 'width' both have computed values of 'auto' and the element has an intrinsic ratio but no intrinsic height or width, then the used value of
             // 'width' is undefined in CSS 2.1. However, it is suggested that, if the containing block's width does not itself depend on the replaced element's width, then
             // the used value of 'width' is calculated from the constraint equation used for block-level, non-replaced elements in normal flow.
             if (heightIsAuto && !hasIntrinsicWidth && !hasIntrinsicHeight) {
                 // The aforementioned 'constraint equation' used for block-level, non-replaced elements in normal flow:
                 // 'margin-left' + 'border-left-width' + 'padding-left' + 'width' + 'padding-right' + 'border-right-width' + 'margin-right' = width of containing block
                 LayoutUnit logicalWidth;
-                if (RenderBlock* blockWithWidth = firstContainingBlockWithLogicalWidth(this))
+                // FIXME: This walking up the containgBlock chain to find the first one with a specified width is bonkers.
+                // If nothing else, it requires making sure that computeReplacedLogicalWidthRespectingMinMaxWidth cannot
+                // depend on the width of the replaced element or we infinite loop. Right now we do that in
+                // firstContainingBlockWithLogicalWidth by checking that width/min-width/max-width are all specified.
+                //
+                // Firefox 27 seems to only do this if the <svg> has a viewbox.
+                if (RenderBlock* blockWithWidth = firstContainingBlockWithLogicalWidth(this)) {
                     logicalWidth = blockWithWidth->computeReplacedLogicalWidthRespectingMinMaxWidth(blockWithWidth->computeReplacedLogicalWidthUsing(blockWithWidth->style()->logicalWidth()), shouldComputePreferred);
-                else
+                } else {
+                    // FIXME: If shouldComputePreferred == ComputePreferred, then we're reading this during preferred width
+                    // computation, at which point this is reading stale data from a previous layout.
                     logicalWidth = containingBlock()->availableLogicalWidth();
+                }
 
                 // This solves above equation for 'width' (== logicalWidth).
                 LayoutUnit marginStart = minimumValueForLength(style()->marginStart(), logicalWidth);
                 LayoutUnit marginEnd = minimumValueForLength(style()->marginEnd(), logicalWidth);
                 logicalWidth = max<LayoutUnit>(0, logicalWidth - (marginStart + marginEnd + (width() - clientWidth())));
                 if (isPercentageIntrinsicSize)
                     logicalWidth = logicalWidth * constrainedSize.width() / 100;
                 return computeReplacedLogicalWidthRespectingMinMaxWidth(logicalWidth, shouldComputePreferred);
             }
         }
@@ skipping 193 matching lines @@
 
     if (style()) {
         if (v)
             r.inflate(style()->outlineSize());
     }
     computeRectForRepaint(repaintContainer, r);
     return r;
 }
 
 }