Bug 1329796 - Don't cache the mTarget too soon. r=mstange

dom/canvas/CanvasRenderingContext2D.cpp

@@ -566,7 +566,9 @@ public:
   explicit AdjustedTarget(CanvasRenderingContext2D* aCtx,
                           const gfx::Rect *aBounds = nullptr)
   {
-    mTarget = aCtx->mTarget;
+    // There are operations that can invalidate aCtx->mTarget along the way,
+    // so don't cache the pointer to it too soon.
+    mTarget = nullptr;
 
     // All rects in this function are in the device space of ctx->mTarget.
 
@@ -595,7 +597,7 @@ public:
     // are used.
     if (aCtx->NeedToDrawShadow()) {
       mShadowTarget = MakeUnique<AdjustedTargetForShadow>(
-        aCtx, mTarget, boundsAfterFilter, op);
+        aCtx, aCtx->mTarget, boundsAfterFilter, op);
       mTarget = mShadowTarget->DT();
       offsetToFinalDT = mShadowTarget->OffsetToFinalDT();
 
@@ -610,13 +612,19 @@ public:
 
       gfx::IntRect intBounds;
       if (!bounds.ToIntRect(&intBounds)) {
+        if (!mTarget) {
+          mTarget = static_cast<DrawTarget *>(aCtx->mTarget);
+        }
         return;
       }
       mFilterTarget = MakeUnique<AdjustedTargetForFilter>(
-        aCtx, mTarget, offsetToFinalDT, intBounds,
+        aCtx, aCtx->mTarget, offsetToFinalDT, intBounds,
         gfx::RoundedToInt(boundsAfterFilter), op);
       mTarget = mFilterTarget->DT();
     }
+    if (!mTarget) {
+      mTarget = static_cast<DrawTarget *>(aCtx->mTarget);
+    }
   }
 
   ~AdjustedTarget()