Merge 105978 - crash in WebCore::RenderSVGContainer::paint

Source/WebCore/rendering/svg/RenderSVGResource.cpp

Index: Source/WebCore/rendering/svg/RenderSVGResource.cpp
===================================================================
--- Source/WebCore/rendering/svg/RenderSVGResource.cpp	(revision 106008)
+++ Source/WebCore/rendering/svg/RenderSVGResource.cpp	(working copy)
@@ -54,12 +54,23 @@
     if (!svgStyle)
         return 0;
 
+    bool isRenderingMask = false;
+    if (object->frame() && object->frame()->view())
+        isRenderingMask = object->frame()->view()->paintBehavior() & PaintBehaviorRenderingSVGMask;
+
     // If we have no fill/stroke, return 0.
     if (mode == ApplyToFillMode) {
+        // When rendering the mask for a RenderSVGResourceClipper, always use the initial fill paint server, and ignore stroke.
+        if (isRenderingMask) {
+            RenderSVGResourceSolidColor* colorResource = RenderSVGResource::sharedSolidPaintingResource();
+            colorResource->setColor(SVGRenderStyle::initialFillPaintColor());
+            return colorResource;
+        }
+
         if (!svgStyle->hasFill())
             return 0;
     } else {
-        if (!svgStyle->hasStroke())
+        if (!svgStyle->hasStroke() || isRenderingMask)
             return 0;
     }