Bug 307565 - crash when filtering nothing, or <feMerge> with no children.

r=scootermorris

content/svg/content/src/nsSVGFilters.cpp

@@ -1470,6 +1470,8 @@ nsSVGFEMergeElement::Filter(nsSVGFilterInstance *instance)
   PRUint32 width, height, length;
   targetImage->Lock();
   targetImage->GetData(&targetData, &length, &stride);
+  targetImage->GetWidth(&width);
+  targetImage->GetHeight(&height);
    
   PRUint32 count = GetChildCount();
   for (PRUint32 i = 0; i < count; i++) {
@@ -1501,9 +1503,6 @@ nsSVGFEMergeElement::Filter(nsSVGFilterInstance *instance)
     sourceImage->Lock();
     sourceImage->GetData(&sourceData, &length, &stride);
     
-    sourceImage->GetWidth(&width);
-    sourceImage->GetHeight(&height);
-
 #define BLEND(target, source, alpha) \
     target = PR_MIN(255, (target * (255 - alpha))/255 + source)
 

layout/svg/base/src/nsSVGFilterFrame.cpp

@@ -357,6 +357,9 @@ nsSVGFilterFrame::FilterPaint(nsISVGRendererCanvas *aCanvas,
   aTarget->GetBBox(getter_AddRefs(bbox));
 
   if (type == nsIDOMSVGFilterElement::SVG_FUNITS_OBJECTBOUNDINGBOX) {
+    if (!bbox)
+      return NS_OK;
+
     bbox->GetX(&x);
     x += nsSVGUtils::ObjectSpace(bbox, mX, nsSVGUtils::X);
     bbox->GetY(&y);
@@ -494,6 +497,8 @@ NS_IMETHODIMP
 nsSVGFilterFrame::GetInvalidationRegion(nsIFrame *aTarget,
                                         nsISVGRendererRegion **aRegion)
 {
+  *aRegion = nsnull;
+
   nsIContent *targetContent = aTarget->GetContent();
   nsISVGChildFrame *svg;
 
@@ -523,6 +528,9 @@ nsSVGFilterFrame::GetInvalidationRegion(nsIFrame *aTarget,
   svg->GetBBox(getter_AddRefs(bbox));
 
   if (type == nsIDOMSVGFilterElement::SVG_FUNITS_OBJECTBOUNDINGBOX) {
+    if (!bbox)
+      return NS_OK;
+
     bbox->GetX(&x);
     x += nsSVGUtils::ObjectSpace(bbox, mX, nsSVGUtils::X);
     bbox->GetY(&y);