Merge 105978 - crash in WebCore::RenderSVGContainer::paint

Source/WebCore/rendering/svg/SVGInlineTextBox.cpp

Index: Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
===================================================================
--- Source/WebCore/rendering/svg/SVGInlineTextBox.cpp	(revision 106008)
+++ Source/WebCore/rendering/svg/SVGInlineTextBox.cpp	(working copy)
@@ -198,21 +198,10 @@
     const SVGRenderStyle* svgStyle = style->svgStyle();
     ASSERT(svgStyle);
 
-    bool hasFill = svgStyle->hasFill();
-    bool hasStroke = svgStyle->hasStroke();
-
     RenderStyle* selectionStyle = style;
     if (hasSelection) {
         selectionStyle = parentRenderer->getCachedPseudoStyle(SELECTION);
-        if (selectionStyle) {
-            const SVGRenderStyle* svgSelectionStyle = selectionStyle->svgStyle();
-            ASSERT(svgSelectionStyle);
-
-            if (!hasFill)
-                hasFill = svgSelectionStyle->hasFill();
-            if (!hasStroke)
-                hasStroke = svgSelectionStyle->hasStroke();
-        } else
+        if (!selectionStyle)
             selectionStyle = style;
     }
 
@@ -295,6 +284,11 @@
             selectionStyle = style;
     }
 
+    if (textRenderer->frame() && textRenderer->frame()->view() && textRenderer->frame()->view()->paintBehavior() & PaintBehaviorRenderingSVGMask) {
+        hasFill = true;
+        hasStroke = false;
+    }
+
     AffineTransform fragmentTransform;
     unsigned textFragmentsSize = m_textFragments.size();
     for (unsigned i = 0; i < textFragmentsSize; ++i) {