From 96bf7bf8e9952619a7cdfaa424bfa3676ef8f83b Mon Sep 17 00:00:00 2001
From: "longsonr%gmail.com"
 <longsonr%gmail.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Fri, 25 May 2007 09:50:02 +0000
Subject: [PATCH] Bug 381777 - filters crash browser. r+sr=sr=tor

git-svn-id: svn://10.0.0.236/trunk@227003 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/content/svg/content/src/nsSVGFilters.cpp | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/mozilla/content/svg/content/src/nsSVGFilters.cpp b/mozilla/content/svg/content/src/nsSVGFilters.cpp
index 3b9667d197a..1a4a31290d9 100644
--- a/mozilla/content/svg/content/src/nsSVGFilters.cpp
+++ b/mozilla/content/svg/content/src/nsSVGFilters.cpp
@@ -323,16 +323,16 @@ nsSVGFilterResource::AcquireSourceImage(nsIDOMSVGAnimatedString* aIn,
     return NS_ERROR_FAILURE;
   }
 
-  if (aSurface) {
-    *aSurface = nsnull;
-    surface.swap(*aSurface);
-  }
   mInstance->GetFilterSubregion(aFilter, defaultRect, &mRect);
 
   mSourceData = surface->Data();
   mStride = surface->Stride();
 
   *aSourceData = mSourceData;
+  if (aSurface) {
+    *aSurface = nsnull;
+    surface.swap(*aSurface);
+  }
   return NS_OK;
 }
 
@@ -347,10 +347,6 @@ nsSVGFilterResource::AcquireTargetImage(nsIDOMSVGAnimatedString* aResult,
     return NS_ERROR_FAILURE;
   }
 
-  if (aSurface) {
-    *aSurface = mTargetImage;
-    NS_ADDREF(*aSurface);
-  }
   mTargetData = mTargetImage->Data();
   mStride = mTargetImage->Stride();
   gfxIntSize size = mTargetImage->GetSize();
@@ -358,6 +354,10 @@ nsSVGFilterResource::AcquireTargetImage(nsIDOMSVGAnimatedString* aResult,
   mHeight = size.height;
 
   *aTargetData = mTargetData;
+  if (aSurface) {
+    *aSurface = mTargetImage;
+    NS_ADDREF(*aSurface);
+  }
   return NS_OK;
 }