SVG child of html element can not act as display:contents.

SVG elements like <g> do not generate a box when styled as
display:contents in an SVG context. However, when they are children of
HTML elements, they should not generate boxes, and not act as
display:contents.

If treated as display:contents, text child nodes would have SVG text
boxes generated for them causing crashes.

Bug: 820779, 820834
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I1ec7e3af158daa9d56160123cc3c25f6ee3eda62
Reviewed-on: https://chromium-review.googlesource.com/958912Reviewed-by: Fredrik Söderquist <fs@opera.com>
Commit-Queue: Rune Lillesveen <futhark@chromium.org>
Cr-Commit-Position: refs/heads/master@{#542752}

third_party/WebKit/Source/core/dom/Element.cpp

@@ -3659,7 +3659,11 @@ bool Element::ShouldStoreNonLayoutObjectComputedStyle(
   if (style.Display() == EDisplay::kContents && !NeedsReattachLayoutTree())
     DCHECK(!GetLayoutObject() || IsPseudoElement());
 #endif
-
+  if (IsSVGElement()) {
+    Element* parent_element = LayoutTreeBuilderTraversal::ParentElement(*this);
+    if (parent_element && !parent_element->IsSVGElement())
+      return false;
+  }
   return style.Display() == EDisplay::kContents ||
          IsHTMLOptGroupElement(*this) || IsHTMLOptionElement(*this) ||
          IsSVGStopElement(*this);

third_party/WebKit/Source/core/layout/LayoutObjectTest.cpp

@@ -9,6 +9,7 @@
 #include "core/layout/LayoutTestHelper.h"
 #include "core/layout/LayoutTextFragment.h"
 #include "core/layout/LayoutView.h"
+#include "core/svg/SVGGElement.h"
 #include "platform/json/JSONValues.h"
 #include "platform/testing/runtime_enabled_features_test_helpers.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -705,4 +706,22 @@ lime'>
              "\\u0440\\u043E\\u0434\\u0435\\u043D\\u0434\\u0435\\u043D\\n\""));
 }
 
+TEST_F(LayoutObjectTest, DisplayContentsSVGGElementInHTML) {
+  SetBodyInnerHTML(R"HTML(
+    <style>*|g { display:contents}</style>
+    <span id=span></span>
+  )HTML");
+
+  Element* span = GetDocument().getElementById("span");
+  SVGGElement* svg_element = SVGGElement::Create(GetDocument());
+  Text* text = Text::Create(GetDocument(), "text");
+  svg_element->appendChild(text);
+  span->appendChild(svg_element);
+
+  GetDocument().View()->UpdateAllLifecyclePhases();
+
+  ASSERT_FALSE(svg_element->GetLayoutObject());
+  ASSERT_FALSE(text->GetLayoutObject());
+}
+
 }  // namespace blink

third_party/WebKit/Source/core/svg/SVGGElement.h

@@ -25,7 +25,7 @@
 
 namespace blink {
 
-class SVGGElement final : public SVGGraphicsElement {
+class CORE_EXPORT SVGGElement final : public SVGGraphicsElement {
   DEFINE_WRAPPERTYPEINFO();
 
  public: