[librsvg] Don't crash when filters don't exist

[Benjamin Otte <otte src gnome org>]

commit d937c691678803ceda6be701587d997ccd03a1da
Author: Benjamin Otte <otte redhat com>
Date:   Fri Jan 29 12:49:55 2016 +0100

    Don't crash when filters don't exist
    
    We put a new surface on the stack if a filter existed by name but we
    didn't pop it if the name didn't resolve to a real filter.
    
    New test: crash/bug759084.svg
    
    https://bugzilla.gnome.org/show_bug.cgi?id=759084

 rsvg-cairo-draw.c                  |    6 +++---
 tests/fixtures/crash/bug759084.svg |    9 +++++++++
 2 files changed, 12 insertions(+), 3 deletions(-)
---
diff --git a/rsvg-cairo-draw.c b/rsvg-cairo-draw.c
index 4d8fbc2..4152cb7 100644
--- a/rsvg-cairo-draw.c
+++ b/rsvg-cairo-draw.c
@@ -819,10 +819,10 @@ rsvg_cairo_pop_render_stack (RsvgDrawingCtx * ctx)
         cairo_surface_t *output;
 
         filter = rsvg_acquire_node (ctx, state->filter);
-        if (filter && RSVG_NODE_TYPE (filter) == RSVG_NODE_TYPE_FILTER) {
-            output = render->surfaces_stack->data;
-            render->surfaces_stack = g_list_delete_link (render->surfaces_stack, render->surfaces_stack);
+        output = render->surfaces_stack->data;
+        render->surfaces_stack = g_list_delete_link (render->surfaces_stack, render->surfaces_stack);
 
+        if (filter && RSVG_NODE_TYPE (filter) == RSVG_NODE_TYPE_FILTER) {
             needs_destroy = TRUE;
             surface = rsvg_filter_render ((RsvgFilter *) filter, output, ctx, &render->bbox, "2103");
             /* Don't destroy the output surface, it's owned by child_cr */
diff --git a/tests/fixtures/crash/bug759084.svg b/tests/fixtures/crash/bug759084.svg
new file mode 100644
index 0000000..9e8f8f1
--- /dev/null
+++ b/tests/fixtures/crash/bug759084.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg"; viewBox="0 0 10 10">
+  <defs>
+    <filter id="filter">
+    </filter>
+  </defs>
+  <g filter="url(#filter)">
+    <rect fill="red" width="10" height="10" filter="url(#doesnotexist)" />
+  </g>
+</svg>