Don't allow <use> <text> references in clip-path fast-path

third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceClipper.cpp

Index: third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceClipper.cpp
diff --git a/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceClipper.cpp b/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceClipper.cpp
index d26df1fe523da7d7444da8e06cd35d18feb16988..3179cad77ebcb183e603311a10c8a7f0e721201b 100644
--- a/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceClipper.cpp
+++ b/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceClipper.cpp
@@ -36,17 +36,27 @@ namespace blink {
 
 namespace {
 
-bool requiresMask(const SVGElement& childElement) {
-  // TODO(fs): This needs to special-case <use> in a way similar to
-  // contributesToClip. (crbug.com/604677)
-  LayoutObject* layoutObject = childElement.layoutObject();
-  DCHECK(layoutObject);
+bool requiresMask(const LayoutObject& layoutObject) {
   // Only basic shapes or paths are supported for direct clipping. We need to
   // fallback to masking for texts.
-  if (layoutObject->isSVGText())
+  if (layoutObject.isSVGText())
     return true;
   // Current shape in clip-path gets clipped too. Fallback to masking.
-  return layoutObject->styleRef().clipPath();
+  return layoutObject.styleRef().clipPath();
+}
+
+bool requiresMask(const SVGElement& element) {

[f(malita), 2016/12/07 13:58:09]

There seems to be some overlap between contributesToClip() and requiresMask(). 
Maybe in the future we could merge them into something that returns a ternary
enum (determineClipHandling -> none/mask/path)?

[fs, 2016/12/07 14:11:43]

Yes, that sounds like it might work. Will look into it when I get the time.

+  const LayoutObject* layoutObject = element.layoutObject();
+  DCHECK(layoutObject);
+  if (isSVGUseElement(element)) {
+    if (layoutObject->styleRef().clipPath())
+      return true;
+    const SVGGraphicsElement* clippingElement =
+        toSVGUseElement(element).visibleTargetGraphicsElementForClipping();
+    DCHECK(clippingElement);
+    layoutObject = clippingElement->layoutObject();
+  }
+  return requiresMask(*layoutObject);
 }
 
 bool contributesToClip(const SVGGraphicsElement& element) {