Abort the SVG filter content recording if the FilterData was dropped

third_party/WebKit/Source/core/paint/SVGFilterPainter.cpp

Index: third_party/WebKit/Source/core/paint/SVGFilterPainter.cpp
diff --git a/third_party/WebKit/Source/core/paint/SVGFilterPainter.cpp b/third_party/WebKit/Source/core/paint/SVGFilterPainter.cpp
index 94d880cf37d5dfd91548cd705b884404ec238e50..6d6bf86af8f9553c03dd258443305dcdab435619 100644
--- a/third_party/WebKit/Source/core/paint/SVGFilterPainter.cpp
+++ b/third_party/WebKit/Source/core/paint/SVGFilterPainter.cpp
@@ -47,6 +47,12 @@ sk_sp<PaintRecord> SVGFilterRecordingContext::EndContent(
   return content;
 }
 
+void SVGFilterRecordingContext::Abort() {
+  if (!paint_controller_)
+    return;
+  EndContent(FloatRect());
+}
+
 static void PaintFilteredContent(GraphicsContext& context,
                                  const LayoutObject& object,
                                  const FloatRect& bounds,
@@ -115,8 +121,14 @@ void SVGFilterPainter::FinishEffect(
     const LayoutObject& object,
     SVGFilterRecordingContext& recording_context) {
   FilterData* filter_data = filter_.GetFilterDataForLayoutObject(&object);
-  if (!filter_data)
+  if (!filter_data) {
+    // Our state was torn down while we were being painted (selection style for
+    // <text> can have this effect), or it was never created (invalid filter.)
+    // In the former case we may have been in the process of recording content,
+    // so make sure we put recording state into a consistent state.
+    recording_context.Abort();
     return;
+  }
 
   // A painting cycle can occur when an FeImage references a source that
   // makes use of the FeImage itself. This is the first place we would hit