Fix the reference box computation for CSS filter effects.

third_party/WebKit/Source/core/paint/PaintLayer.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
  *   Randall Jesup <rjesup@wgate.com>
@@ skipping 2060 matching lines @@
 LayoutRect PaintLayer::logicalBoundingBox() const
 {
     return layoutObject()->visualOverflowRect();
 }
 
 static inline LayoutRect flippedLogicalBoundingBox(LayoutRect boundingBox, LayoutObject* layoutObjects)
 {
     LayoutRect result = boundingBox;
     if (layoutObjects->isBox())
         toLayoutBox(layoutObjects)->flipForWritingMode(result);
-    else
+    else if (layoutObjects->containingBlock())
         layoutObjects->containingBlock()->flipForWritingMode(result);
     return result;
 }
 
 LayoutRect PaintLayer::physicalBoundingBox(const PaintLayer* ancestorLayer) const
 {
     LayoutPoint offsetFromRoot;
     convertToLayerCoords(ancestorLayer, offsetFromRoot);
     return physicalBoundingBox(offsetFromRoot);
 }
@@ skipping 646 matching lines @@
 
 void showLayerTree(const blink::LayoutObject* layoutObject)
 {
     if (!layoutObject) {
         fprintf(stderr, "Cannot showLayerTree. Root is (nil)\n");
         return;
     }
     showLayerTree(layoutObject->enclosingLayer());
 }
 #endif