Restore checking of SVGResources masker object in ScopedSVGPaintState

An <svg> element can have both a 'mask' and a '-webkit-mask' property (both yielding a Mask paint property), so we need to (re)check the existence of the masker LayoutObject before creating the SVGMaskPainter. Bug: 1063166 Change-Id: I55ce2b22185275b4dd23aefa65316230d98d960b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2111316Reviewed-by: Philip Rogers <pdr@chromium.org> Commit-Queue: Fredrik Söderquist <fs@opera.com> Cr-Commit-Position: refs/heads/master@{#752007}

Restore checking of SVGResources masker object in ScopedSVGPaintState
An <svg> element can have both a 'mask' and a '-webkit-mask' property (both yielding a Mask paint property), so we need to (re)check the existence of the masker LayoutObject before creating the SVGMaskPainter. Bug: 1063166 Change-Id: I55ce2b22185275b4dd23aefa65316230d98d960b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2111316Reviewed-by: Philip Rogers <pdr@chromium.org> Commit-Queue: Fredrik Söderquist <fs@opera.com> Cr-Commit-Position: refs/heads/master@{#752007}
882958ff · Fredrik Söderqvist · Commit Bot · fb8d11af · 882958ff · 882958ff
Commit 882958ff authored Mar 20, 2020 by Fredrik Söderqvist Committed by Commit Bot Mar 20, 2020
4 changed files
--- a/third_party/blink/renderer/core/paint/scoped_svg_paint_state.cc
+++ b/third_party/blink/renderer/core/paint/scoped_svg_paint_state.cc
@@ -102,12 +102,15 @@ bool ScopedSVGPaintState::ApplyEffects() {
    ApplyClipIfNecessary();
  }

-  ApplyMaskIfNecessary();
+  SVGResources* resources =
+      SVGResourcesCache::CachedResourcesForLayoutObject(object_);
+
+  ApplyMaskIfNecessary(resources);

  if (is_svg_root_or_foreign_object) {
    // PaintLayerPainter takes care of filter.
    DCHECK(object_.HasLayer() || !object_.StyleRef().HasFilter());
-  } else if (!ApplyFilterIfNecessary()) {
+  } else if (!ApplyFilterIfNecessary(resources)) {
    return false;
  }
  return true;
@@ -147,8 +150,8 @@ void ScopedSVGPaintState::ApplyClipIfNecessary() {
  }
 }

-void ScopedSVGPaintState::ApplyMaskIfNecessary() {
-  if (object_.StyleRef().SvgStyle().MaskerResource())
+void ScopedSVGPaintState::ApplyMaskIfNecessary(SVGResources* resources) {
+  if (resources && resources->Masker())
    mask_painter_.emplace(paint_info_.context, object_, display_item_client_);
 }

@@ -161,9 +164,7 @@ static bool HasReferenceFilterOnly(const ComputedStyle& style) {
  return operations.at(0)->GetType() == FilterOperation::REFERENCE;
 }

-bool ScopedSVGPaintState::ApplyFilterIfNecessary() {
-  SVGResources* resources =
-      SVGResourcesCache::CachedResourcesForLayoutObject(object_);
+bool ScopedSVGPaintState::ApplyFilterIfNecessary(SVGResources* resources) {
  if (!resources)
    return !HasReferenceFilterOnly(object_.StyleRef());
  LayoutSVGResourceFilter* filter = resources->Filter();

--- a/third_party/blink/renderer/core/paint/scoped_svg_paint_state.h
+++ b/third_party/blink/renderer/core/paint/scoped_svg_paint_state.h
@@ -38,6 +38,7 @@ namespace blink {

 class FilterData;
 class LayoutObject;
+class SVGResources;

 // Hooks up the correct paint property transform node.
 class ScopedSVGTransformState {
@@ -104,11 +105,11 @@ class ScopedSVGPaintState {
 private:
  void ApplyPaintPropertyState();
  void ApplyClipIfNecessary();
-  void ApplyMaskIfNecessary();
+  void ApplyMaskIfNecessary(SVGResources*);

  // Return true if no filtering is necessary or if the filter is successfully
  // applied.
-  bool ApplyFilterIfNecessary();
+  bool ApplyFilterIfNecessary(SVGResources*);

  const LayoutObject& object_;
  PaintInfo paint_info_;

--- a/third_party/blink/web_tests/css3/masking/mask-invalid-svg-root-expected.html
+++ b/third_party/blink/web_tests/css3/masking/mask-invalid-svg-root-expected.html
+<!doctype html>
+<div style="width: 100px; height: 100px; background-color: green"></div>
--- a/third_party/blink/web_tests/css3/masking/mask-invalid-svg-root.html
+++ b/third_party/blink/web_tests/css3/masking/mask-invalid-svg-root.html
+<!doctype html>
+<title>CSS Masking: An invalid mask reference generates a transparent black mask</title>
+<div style="width: 100px; height: 100px; background-color: green">
+  <svg mask="url(#nonexistent)" style="-webkit-mask: url(#nonexistent)">
+    <rect width="100" height="100" fill="red"/>
+  </svg>
+</div>