Merge 105978 - crash in WebCore::RenderSVGContainer::paint

Source/WebCore/rendering/svg/SVGInlineTextBox.cpp

 /**
  * Copyright (C) 2007 Rob Buis <buis@kde.org>
  * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 180 matching lines @@
     ASSERT(textRenderer);
     if (!textShouldBePainted(textRenderer))
         return;
 
     RenderStyle* style = parentRenderer->style();
     ASSERT(style);
 
     const SVGRenderStyle* svgStyle = style->svgStyle();
     ASSERT(svgStyle);
 
-    bool hasFill = svgStyle->hasFill();
-    bool hasStroke = svgStyle->hasStroke();
-
     RenderStyle* selectionStyle = style;
     if (hasSelection) {
         selectionStyle = parentRenderer->getCachedPseudoStyle(SELECTION);
-        if (selectionStyle) {
-            const SVGRenderStyle* svgSelectionStyle = selectionStyle->svgStyle();
-            ASSERT(svgSelectionStyle);
-
-            if (!hasFill)
-                hasFill = svgSelectionStyle->hasFill();
-            if (!hasStroke)
-                hasStroke = svgSelectionStyle->hasStroke();
-        } else
+        if (!selectionStyle)
             selectionStyle = style;
     }
 
     int startPosition, endPosition;
     selectionStartEnd(startPosition, endPosition);
 
     int fragmentStartPosition = 0;
     int fragmentEndPosition = 0;
     AffineTransform fragmentTransform;
     unsigned textFragmentsSize = m_textFragments.size();
@@ skipping 62 matching lines @@
             ASSERT(svgSelectionStyle);
 
             if (!hasFill)
                 hasFill = svgSelectionStyle->hasFill();
             if (!hasStroke)
                 hasStroke = svgSelectionStyle->hasStroke();
         } else
             selectionStyle = style;
     }
 
+    if (textRenderer->frame() && textRenderer->frame()->view() && textRenderer->frame()->view()->paintBehavior() & PaintBehaviorRenderingSVGMask) {
+        hasFill = true;
+        hasStroke = false;
+    }
+
     AffineTransform fragmentTransform;
     unsigned textFragmentsSize = m_textFragments.size();
     for (unsigned i = 0; i < textFragmentsSize; ++i) {
         SVGTextFragment& fragment = m_textFragments.at(i);
         ASSERT(!m_paintingResource);
 
         GraphicsContextStateSaver stateSaver(*paintInfo.context);
         fragment.buildFragmentTransform(fragmentTransform);
         if (!fragmentTransform.isIdentity())
             paintInfo.context->concatCTM(fragmentTransform);
@@ skipping 440 matching lines @@
                     return true;
              }
         }
     }
     return false;
 }
 
 } // namespace WebCore
 
 #endif