From f9ae2860ab490f93ef02a49713d11ab494cf4d60 Mon Sep 17 00:00:00 2001
From: cku <cku@mozilla.com>
Date: Fri, 28 Apr 2017 11:48:21 +0800
Subject: [PATCH] Bug 1360343 - ensure maskSurface is not null before
 dereference, since it can be null because of OOM or gfx device reset.
 r=dvander

MozReview-Commit-ID: HX2qsWLZpMg

--HG--
extra : rebase_source : 046befc11151461a682842c31e2ce39247a5e1d8
---
 gfx/2d/2D.h                   | 3 +++
 layout/svg/nsSVGMaskFrame.cpp | 3 ++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/gfx/2d/2D.h b/gfx/2d/2D.h
index c1fba3463a..e2020dc9e6 100644
--- a/gfx/2d/2D.h
+++ b/gfx/2d/2D.h
@@ -488,6 +488,9 @@ public:
   /**
    * Returns a DataSourceSurface with the same data as this one, but
    * guaranteed to have surface->GetType() == SurfaceType::DATA.
+   *
+   * The returning surface might be null, because of OOM or gfx device reset.
+   * The caller needs to do null-check before using it.
    */
   virtual already_AddRefed<DataSourceSurface> GetDataSurface() override;
 
diff --git a/layout/svg/nsSVGMaskFrame.cpp b/layout/svg/nsSVGMaskFrame.cpp
index b8e4b32ae9..a22833d61a 100644
--- a/layout/svg/nsSVGMaskFrame.cpp
+++ b/layout/svg/nsSVGMaskFrame.cpp
@@ -274,7 +274,8 @@ nsSVGMaskFrame::GetMaskForMaskedFrame(gfxContext* aContext,
   }
   RefPtr<DataSourceSurface> maskSurface = maskSnapshot->GetDataSurface();
   DataSourceSurface::MappedSurface map;
-  if (!maskSurface->Map(DataSourceSurface::MapType::READ, &map)) {
+  if (!maskSurface ||
+      !maskSurface->Map(DataSourceSurface::MapType::READ, &map)) {
     return nullptr;
   }