Merge 105978 - crash in WebCore::RenderSVGContainer::paint

Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp

Index: Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp
===================================================================
--- Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp	(revision 106008)
+++ Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp	(working copy)
@@ -117,7 +117,10 @@
         maskImageContext->translate(-clampedAbsoluteTargetRect.x(), -clampedAbsoluteTargetRect.y());
         maskImageContext->concatCTM(absoluteTransform);
 
-        drawContentIntoMaskImage(maskerData, colorSpace, maskElement, object);
+        if (!drawContentIntoMaskImage(maskerData, colorSpace, maskElement, object)) {
+            maskImageContext->restore();
+            maskerData->maskImage.clear();
+        }
     }
 
     if (!maskerData->maskImage)
@@ -127,7 +130,7 @@
     return true;
 }
 
-void RenderSVGResourceMasker::drawContentIntoMaskImage(MaskerData* maskerData, ColorSpace colorSpace, const SVGMaskElement* maskElement, RenderObject* object)
+bool RenderSVGResourceMasker::drawContentIntoMaskImage(MaskerData* maskerData, ColorSpace colorSpace, const SVGMaskElement* maskElement, RenderObject* object)
 {
     GraphicsContext* maskImageContext = maskerData->maskImage->context();
     ASSERT(maskImageContext);
@@ -146,6 +149,8 @@
         RenderObject* renderer = node->renderer();
         if (!node->isSVGElement() || !static_cast<SVGElement*>(node)->isStyled() || !renderer)
             continue;
+        if (renderer->needsLayout())
+            return false;
         RenderStyle* style = renderer->style();
         if (!style || style->display() == NONE || style->visibility() != VISIBLE)
             continue;
@@ -162,6 +167,7 @@
 
     // Create the luminance mask.
     maskerData->maskImage->convertToLuminanceMask();
+    return true;
 }
 
 void RenderSVGResourceMasker::calculateMaskContentRepaintRect()