Bug 782888 - Do not propagate nsChangeHint_UpdateEffects to text nodes. r=bz

layout/base/nsFrameManager.cpp

@@ -986,6 +986,14 @@ CaptureChange(nsStyleContext* aOldContext, nsStyleContext* aNewContext,
                (ourChange & nsChangeHint_NeedReflow),
                "Reflow hint bits set without actually asking for a reflow");
 
+  // nsChangeHint_UpdateEffects is inherited, but it can be set due to changes
+  // in inherited properties (fill and stroke).  Avoid propagating it into
+  // text nodes.
+  if ((ourChange & nsChangeHint_UpdateEffects) &&
+      aContent && !aContent->IsElement()) {
+    ourChange = NS_SubtractHint(ourChange, nsChangeHint_UpdateEffects);
+  }
+
   NS_UpdateHint(ourChange, aChangeToAssume);
   if (NS_UpdateHint(aMinChange, ourChange)) {
     if (!(ourChange & nsChangeHint_ReconstructFrame) || aContent) {

layout/reftests/svg/dynamic-fill-01-ref.svg

@@ -0,0 +1,12 @@
+<!--
+    Any copyright is dedicated to the Public Domain.
+    http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+
+  <title>Reference for changing fill from url() value to a solid color value not asserting</title>
+
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=782888 -->
+
+  <text style="font: 16px sans-serif; fill: green" x="100" y="100">Hello</text>
+</svg>

layout/reftests/svg/dynamic-fill-01.svg

@@ -0,0 +1,23 @@
+<!--
+    Any copyright is dedicated to the Public Domain.
+    http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+
+  <title>Test for changing fill from url() value to a solid color value not asserting</title>
+
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=782888 -->
+
+  <linearGradient id="g">
+    <stop stop-color="red"/>
+  </linearGradient>
+
+  <text style="font: 16px sans-serif; fill: url(#g)" x="100" y="100">Hello</text>
+
+  <script>
+    window.addEventListener("MozReftestInvalidate", function() {
+      document.getElementsByTagName("text")[0].style.fill = "green";
+      document.documentElement.removeAttribute("class");
+    }, false);
+  </script>
+</svg>

layout/reftests/svg/reftest.list

@@ -71,6 +71,7 @@ fuzzy-if(/^Windows\x20NT\x206\.1/.test(http.oscpu),1,2) == clipPath-and-shape-re
 == dynamic-clipPath-02.svg pass.svg
 == dynamic-feFlood-01.svg pass.svg
 == dynamic-feImage-01.svg pass.svg
+== dynamic-fill-01.svg dynamic-fill-01-ref.svg
 == dynamic-filter-contents-01a.svg dynamic-filter-contents-01-ref.svg
 == dynamic-filter-contents-01b.svg dynamic-filter-contents-01-ref.svg
 == dynamic-gradient-contents-01.svg pass.svg