Bug 1267272 - NULL pointer mozilla::dom::SVGSVGElement::GetIntrinsicHeight. r=seth

dom/svg/crashtests/1267272-1.svg

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+  <filter id="f">
+  	<feImage xlink:href="invalid-image.svg"/>
+  </filter>
+  <rect filter='url(#f)' width="1" height="1"/>
+</svg>

dom/svg/crashtests/crashtests.list

@@ -75,6 +75,7 @@ load 898915-1.svg
 load 1035248-1.svg
 load 1035248-2.svg
 load 1244898-1.xhtml
+load 1267272-1.svg
 # Disabled for now due to it taking a very long time to run - bug 1259356
 #load long-clipPath-reference-chain.svg
 load zero-size-image.svg

dom/svg/crashtests/invalid-image.svg

@@ -0,0 +1 @@
+X

image/VectorImage.cpp

@@ -686,6 +686,10 @@ VectorImage::IsOpaque()
 NS_IMETHODIMP_(already_AddRefed<SourceSurface>)
 VectorImage::GetFrame(uint32_t aWhichFrame, uint32_t aFlags)
 {
+  if (mError) {
+    return nullptr;
+  }
+
   // Look up height & width
   // ----------------------
   SVGSVGElement* svgElem = mSVGDocumentWrapper->GetRootSVGElem();