Bug 1308859 - Do not hold on to pointers into mStyleStack across a presshell flush. r=jrmuizel

MozReview-Commit-ID: Cenm0J8rNq7

--HG--
extra : rebase_source : 8bf6cf74c270170ae211692337e791d8aef23ada

dom/canvas/CanvasRenderingContext2D.h

@@ -696,6 +696,7 @@ protected:
   /**
    * Update CurrentState().filter with the filter description for
    * CurrentState().filterChain.
+   * Flushes the PresShell, so the world can change if you call this function.
    */
   void UpdateFilter();
 
@@ -873,13 +874,12 @@ protected:
    * last call to UpdateFilter and now.
    */
   const gfx::FilterDescription& EnsureUpdatedFilter() {
-    const ContextState& state = CurrentState();
     bool isWriteOnly = mCanvasElement && mCanvasElement->IsWriteOnly();
-    if (state.filterSourceGraphicTainted != isWriteOnly) {
+    if (CurrentState().filterSourceGraphicTainted != isWriteOnly) {
       UpdateFilter();
     }
-    MOZ_ASSERT(state.filterSourceGraphicTainted == isWriteOnly);
-    return state.filter;
+    MOZ_ASSERT(CurrentState().filterSourceGraphicTainted == isWriteOnly);
+    return CurrentState().filter;
   }
 
   bool NeedToCalculateBounds()