Bug 1222812 - add a null check in case there is no old style. r=dholbert

layout/svg/crashtests/1223281-1.svg

@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+<![CDATA[
+
+function forceFrameConstruction()
+{
+    document.documentElement.getBoundingClientRect();
+}
+
+function boom()
+{
+    document.documentElement.style.overflow = "scroll";
+    forceFrameConstruction()
+    document.documentElement.style.visibility = "visible";
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+<rect style="perspective: 10em;" />
+</svg>
+

layout/svg/crashtests/crashtests.list

@@ -194,4 +194,5 @@ load 1140080-1.svg
 load 1149542-1.svg
 load 1182496-1.html
 load 1209525-1.svg
+load 1223281-1.svg
 load extref-test-1.xhtml

layout/svg/nsSVGPathGeometryFrame.cpp

@@ -153,9 +153,9 @@ nsSVGPathGeometryFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
   nsSVGPathGeometryFrameBase::DidSetStyleContext(aOldStyleContext);
 
   if (aOldStyleContext) {
-    float oldOpacity = aOldStyleContext->PeekStyleDisplay()->mOpacity;
-    float newOpacity = StyleDisplay()->mOpacity;
-    if (newOpacity != oldOpacity &&
+    auto oldStyleDisplay = aOldStyleContext->PeekStyleDisplay();
+    if (oldStyleDisplay &&
+        StyleDisplay()->mOpacity != oldStyleDisplay->mOpacity &&
         nsSVGUtils::CanOptimizeOpacity(this)) {
       // nsIFrame::BuildDisplayListForStackingContext() is not going to create an
       // nsDisplayOpacity display list item, so DLBI won't invalidate for us.
@@ -165,10 +165,9 @@ nsSVGPathGeometryFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
     nsSVGPathGeometryElement* element =
       static_cast<nsSVGPathGeometryElement*>(mContent);
 
-    if (aOldStyleContext->PeekStyleSVG() &&
-        !SVGContentUtils::ShapeTypeHasNoCorners(mContent)) {
-      if ((StyleSVG()->mStrokeLinecap !=
-             aOldStyleContext->PeekStyleSVG()->mStrokeLinecap) &&
+    auto oldStyleSVG = aOldStyleContext->PeekStyleSVG();
+    if (oldStyleSVG && !SVGContentUtils::ShapeTypeHasNoCorners(mContent)) {
+      if (StyleSVG()->mStrokeLinecap != oldStyleSVG->mStrokeLinecap &&
           element->IsSVGElement(nsGkAtoms::path)) {
         // If the stroke-linecap changes to or from "butt" then our element
         // needs to update its cached Moz2D Path, since SVGPathData::BuildPath
@@ -176,15 +175,13 @@ nsSVGPathGeometryFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
         // length subpaths base on that property.
         element->ClearAnyCachedPath();
       } else if (GetStateBits() & NS_STATE_SVG_CLIPPATH_CHILD) {
-        if (StyleSVG()->mClipRule !=
-              aOldStyleContext->PeekStyleSVG()->mClipRule) {
+        if (StyleSVG()->mClipRule != oldStyleSVG->mClipRule) {
           // Moz2D Path objects are fill-rule specific.
           // For clipPath we use clip-rule as the path's fill-rule.
           element->ClearAnyCachedPath();
         }
       } else {
-        if (StyleSVG()->mFillRule !=
-              aOldStyleContext->PeekStyleSVG()->mFillRule) {
+        if (StyleSVG()->mFillRule != oldStyleSVG->mFillRule) {
           // Moz2D Path objects are fill-rule specific.
           element->ClearAnyCachedPath();
         }