Don't allow <use> <text> references in clip-path fast-path

third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceClipper.cpp

 /*
  * Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Rob Buis <buis@kde.org>
  * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
  * Copyright (C) 2011 Dirk Schulze <krit@webkit.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 18 matching lines @@
 #include "core/svg/SVGGeometryElement.h"
 #include "core/svg/SVGUseElement.h"
 #include "platform/graphics/paint/SkPictureBuilder.h"
 #include "third_party/skia/include/core/SkPicture.h"
 #include "third_party/skia/include/pathops/SkPathOps.h"
 
 namespace blink {
 
 namespace {
 
-bool requiresMask(const SVGElement& childElement) {
-  // TODO(fs): This needs to special-case <use> in a way similar to
-  // contributesToClip. (crbug.com/604677)
-  LayoutObject* layoutObject = childElement.layoutObject();
-  DCHECK(layoutObject);
+bool requiresMask(const LayoutObject& layoutObject) {
   // Only basic shapes or paths are supported for direct clipping. We need to
   // fallback to masking for texts.
-  if (layoutObject->isSVGText())
+  if (layoutObject.isSVGText())
     return true;
   // Current shape in clip-path gets clipped too. Fallback to masking.
-  return layoutObject->styleRef().clipPath();
+  return layoutObject.styleRef().clipPath();
+}
+
+bool requiresMask(const SVGElement& element) {

[f(malita), 2016/12/07 13:58:09]

There seems to be some overlap between contributesToClip() and requiresMask(). 
Maybe in the future we could merge them into something that returns a ternary
enum (determineClipHandling -> none/mask/path)?

[fs, 2016/12/07 14:11:43]

Yes, that sounds like it might work. Will look into it when I get the time.

+  const LayoutObject* layoutObject = element.layoutObject();
+  DCHECK(layoutObject);
+  if (isSVGUseElement(element)) {
+    if (layoutObject->styleRef().clipPath())
+      return true;
+    const SVGGraphicsElement* clippingElement =
+        toSVGUseElement(element).visibleTargetGraphicsElementForClipping();
+    DCHECK(clippingElement);
+    layoutObject = clippingElement->layoutObject();
+  }
+  return requiresMask(*layoutObject);
 }
 
 bool contributesToClip(const SVGGraphicsElement& element) {
   const LayoutObject* layoutObject = element.layoutObject();
   if (!layoutObject)
     return false;
   const ComputedStyle& style = layoutObject->styleRef();
   if (style.display() == EDisplay::None ||
       style.visibility() != EVisibility::Visible)
     return false;
@@ skipping 232 matching lines @@
       toSVGClipPathElement(element())->calculateTransform(
           SVGElement::IncludeMotionTransform);
   if (clipPathUnits() == SVGUnitTypes::kSvgUnitTypeObjectboundingbox) {
     transform.translate(referenceBox.x(), referenceBox.y());
     transform.scaleNonUniform(referenceBox.width(), referenceBox.height());
   }
   return transform.mapRect(m_localClipBounds);
 }
 
 }  // namespace blink