Bug 444925 – Crash [@ nsContextBoxBlur::BoxBlurHorizontal] with mathml:munderover and text-shadow. r+sr=roc

layout/base/crashtests/444925-1.xul

@@ -0,0 +1,10 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:mathml="http://www.w3.org/1998/Math/MathML">
+<box>
+m
+<mathml:munderover style="padding-left: 20%; padding-right: 50%; text-shadow: 0px 0px 5px orange; text-decoration: overline;">
+m
+<box/>
+<box/>
+</mathml:munderover>
+</box>
+</window>

layout/base/crashtests/crashtests.list

@@ -109,3 +109,4 @@ load 409461-1.xhtml
 load 410967.html
 load 411870-1.html
 load 412651-1.html
+load 444925-1.xul

layout/base/nsCSSRendering.cpp

@@ -4824,14 +4824,20 @@ nsContextBoxBlur::Init(const gfxRect& aRect, nscoord aBlurRadius,
     return mContext;
   }
 
-  mDestinationCtx = aDestinationCtx;
-
   // Convert from app units to device pixels
   mRect = aRect;
   mRect.Outset(aBlurRadius);
   mRect.ScaleInverse(aAppUnitsPerDevPixel);
   mRect.RoundOut();
 
+  if (mRect.IsEmpty()) {
+    mBlurRadius = 0;
+    mContext = aDestinationCtx;
+    return mContext;
+  }
+
+  mDestinationCtx = aDestinationCtx;
+
   // Make an alpha-only surface to draw on. We will play with the data after everything is drawn
   // to create a blur effect.
   mImageSurface = new gfxImageSurface(gfxIntSize(mRect.Width(), mRect.Height()),