Fix invalid selection produced when dragging mouse outside the SVG text element

third_party/WebKit/Source/core/layout/svg/LayoutSVGRoot.cpp

Index: third_party/WebKit/Source/core/layout/svg/LayoutSVGRoot.cpp
diff --git a/third_party/WebKit/Source/core/layout/svg/LayoutSVGRoot.cpp b/third_party/WebKit/Source/core/layout/svg/LayoutSVGRoot.cpp
index fbe5909f7a0917a37e843ac9a56c9a385ae59861..bdb89918b9ee5271d52f21821ea4ee8954284fe7 100644
--- a/third_party/WebKit/Source/core/layout/svg/LayoutSVGRoot.cpp
+++ b/third_party/WebKit/Source/core/layout/svg/LayoutSVGRoot.cpp
@@ -28,6 +28,7 @@
 #include "core/layout/LayoutAnalyzer.h"
 #include "core/layout/LayoutPart.h"
 #include "core/layout/LayoutView.h"
+#include "core/layout/svg/LayoutSVGText.h"
 #include "core/layout/svg/SVGLayoutSupport.h"
 #include "core/layout/svg/SVGResourcesCache.h"
 #include "core/paint/PaintLayer.h"
@@ -281,6 +282,33 @@ void LayoutSVGRoot::willBeRemovedFromTree()
     LayoutReplaced::willBeRemovedFromTree();
 }
 
+PositionWithAffinity LayoutSVGRoot::positionForPoint(const LayoutPoint& point)
+{
+    FloatPoint absolutePoint = FloatPoint(point);
+    absolutePoint = m_localToBorderBoxTransform.inverse().mapPoint(absolutePoint);
+    LayoutObject* closestDescendant = SVGLayoutSupport::findClosestLayoutSVGText(this, absolutePoint);
+
+    if (!closestDescendant)
+        return LayoutReplaced::positionForPoint(point);
+
+    if (closestDescendant)

[fs, 2016/01/19 16:12:46]

You trivially know this (checked 3 lines before.) The toLayoutSVGText cast below
should also be asserting this already (and more firmly so.)

+        ASSERT(closestDescendant->isSVGText());
+
+    LayoutObject* layoutObject = closestDescendant;
+    AffineTransform transform = closestDescendant->localToParentTransform();
+    transform.translate(toLayoutSVGText(closestDescendant)->location().x(), toLayoutSVGText(closestDescendant)->location().y());
+    while (layoutObject) {
+        layoutObject = layoutObject->parent();
+        if (layoutObject->isSVGRoot())
+            break;
+        transform = layoutObject->localToParentTransform() * transform;
+    }
+
+    absolutePoint = transform.inverse().mapPoint(absolutePoint);
+
+    return closestDescendant->positionForPoint(LayoutPoint(absolutePoint));
+}
+
 // LayoutBox methods will expect coordinates w/o any transforms in coordinates
 // relative to our borderBox origin.  This method gives us exactly that.
 void LayoutSVGRoot::buildLocalToBorderBoxTransform()