[librsvg] Fix crash when trying to release a reference we don't own

[Florian Müllner <fmuellner src gnome org>]

commit 1d9e887d42ccd3077a3a867815a5733e91b654bb
Author: Florian Müllner <fmuellner gnome org>
Date:   Thu Oct 29 09:33:24 2015 +0100

    Fix crash when trying to release a reference we don't own
    
    Commit 9fc56102ca changed the condition for creating a new surface,
    but did not update the condition for freeing it, resulting in a
    crash when trying to release a reference we don't own.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=757286

 rsvg-cairo-draw.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)
---
diff --git a/rsvg-cairo-draw.c b/rsvg-cairo-draw.c
index fd77fff..37cdb56 100644
--- a/rsvg-cairo-draw.c
+++ b/rsvg-cairo-draw.c
@@ -810,7 +810,7 @@ rsvg_cairo_pop_render_stack (RsvgDrawingCtx * ctx)
     RsvgClipPath *lateclip = NULL;
     cairo_surface_t *surface = NULL;
     RsvgState *state = rsvg_current_state (ctx);
-    gboolean nest;
+    gboolean nest, needs_destroy = FALSE;
 
     if (rsvg_current_state (ctx)->clip_path) {
         RsvgNode *node;
@@ -838,6 +838,7 @@ rsvg_cairo_pop_render_stack (RsvgDrawingCtx * ctx)
             output = render->surfaces_stack->data;
             render->surfaces_stack = g_list_delete_link (render->surfaces_stack, render->surfaces_stack);
 
+            needs_destroy = TRUE;
             surface = rsvg_filter_render ((RsvgFilter *) filter, output, ctx, &render->bbox, "2103");
             /* Don't destroy the output surface, it's owned by child_cr */
         }
@@ -882,7 +883,7 @@ rsvg_cairo_pop_render_stack (RsvgDrawingCtx * ctx)
     g_free (render->bb_stack->data);
     render->bb_stack = g_list_delete_link (render->bb_stack, render->bb_stack);
 
-    if (state->filter) {
+    if (needs_destroy) {
         cairo_surface_destroy (surface);
     }
 }