From 21c5dfed1ee2a86ff23f740df310f46d8e08579e Mon Sep 17 00:00:00 2001
From: Cameron McCormack <cam@mcc.id.au>
Date: Fri, 24 Jul 2015 09:22:01 +1000
Subject: [PATCH] Bug 1185266 - Look up painting properties on the SVGTextFrame
 when painting text frames that are direct children of <text>. r=jwatt

---
 layout/reftests/bugs/1185266-1-ref.svg |  9 +++++++++
 layout/reftests/bugs/1185266-1.svg     | 23 +++++++++++++++++++++++
 layout/svg/nsSVGEffects.cpp            | 14 ++++++++++++--
 3 files changed, 44 insertions(+), 2 deletions(-)
 create mode 100644 layout/reftests/bugs/1185266-1-ref.svg
 create mode 100644 layout/reftests/bugs/1185266-1.svg

diff --git a/layout/reftests/bugs/1185266-1-ref.svg b/layout/reftests/bugs/1185266-1-ref.svg
new file mode 100644
index 00000000000..e1eaeb0b294
--- /dev/null
+++ b/layout/reftests/bugs/1185266-1-ref.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <style>
+    text { fill: url(#green); }
+  </style>
+  <linearGradient id="green">
+    <stop stop-color="green"/>
+  </linearGradient>
+  <text x="10" y="20">This text must be green.</text>
+</svg>
diff --git a/layout/reftests/bugs/1185266-1.svg b/layout/reftests/bugs/1185266-1.svg
new file mode 100644
index 00000000000..fb90ea2d38f
--- /dev/null
+++ b/layout/reftests/bugs/1185266-1.svg
@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+  <style>
+    g { fill: url(#red); }
+    g.x { fill: url(#green); }
+  </style>
+  <linearGradient id="red">
+    <stop stop-color="red"/>
+  </linearGradient>
+  <linearGradient id="green">
+    <stop stop-color="green"/>
+  </linearGradient>
+  <g>
+    <text x="10" y="20">This text must be green.</text>
+  </g>
+  <script>
+    function run() {
+      var g = document.querySelector("g");
+      g.setAttribute("class", "x");
+      document.documentElement.removeAttribute("class");
+    }
+    document.addEventListener("MozReftestInvalidate", run, false);
+  </script>
+</svg>
diff --git a/layout/svg/nsSVGEffects.cpp b/layout/svg/nsSVGEffects.cpp
index d35f3c69e9d..9bf0ca173e4 100644
--- a/layout/svg/nsSVGEffects.cpp
+++ b/layout/svg/nsSVGEffects.cpp
@@ -572,8 +572,18 @@ nsSVGEffects::GetPaintServer(nsIFrame *aTargetFrame, const nsStyleSVGPaint *aPai
   if (aPaint->mType != eStyleSVGPaintType_Server)
     return nullptr;
 
-  nsIFrame *frame = aTargetFrame->GetContent()->IsNodeOfType(nsINode::eTEXT) ?
-                      aTargetFrame->GetParent() : aTargetFrame;
+  // If we're looking at a frame within SVG text, then we need to look up
+  // to find the right frame to get the painting property off.  We should at
+  // least look up past a text frame, and if the text frame's parent is the
+  // anonymous block frame, then we look up to its parent (the SVGTextFrame).
+  nsIFrame* frame = aTargetFrame;
+  if (frame->GetContent()->IsNodeOfType(nsINode::eTEXT)) {
+    frame = frame->GetParent();
+    nsIFrame* grandparent = frame->GetParent();
+    if (grandparent && grandparent->GetType() == nsGkAtoms::svgTextFrame) {
+      frame = grandparent;
+    }
+  }
   nsSVGPaintingProperty *property =
     nsSVGEffects::GetPaintingProperty(aPaint->mPaint.mPaintServer, frame, aType);
   if (!property)