[SVG] Reject hit-test queries when the element has a singular transform

Source/core/rendering/svg/RenderSVGRoot.cpp

 /*
  * Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2007, 2008, 2009 Rob Buis <buis@kde.org>
  * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Google, Inc.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 407 matching lines @@
 }
 
 bool RenderSVGRoot::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
 {
     LayoutPoint pointInParent = locationInContainer.point() - toLayoutSize(accumulatedOffset);
     LayoutPoint pointInBorderBox = pointInParent - toLayoutSize(location());
 
     // Only test SVG content if the point is in our content box.
     // FIXME: This should be an intersection when rect-based hit tests are supported by nodeAtFloatPoint.
     if (contentBoxRect().contains(pointInBorderBox)) {
-        FloatPoint localPoint = localToParentTransform().inverse().mapPoint(FloatPoint(pointInParent));
+        const AffineTransform& localToParentTransform = this->localToParentTransform();
+        if (localToParentTransform.isInvertible()) {
+            FloatPoint localPoint = localToParentTransform.inverse().mapPoint(FloatPoint(pointInParent));
 
-        for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
-            // FIXME: nodeAtFloatPoint() doesn't handle rect-based hit tests yet.
-            if (child->nodeAtFloatPoint(request, result, localPoint, hitTestAction)) {
-                updateHitTestResult(result, pointInBorderBox);
-                if (!result.addNodeToRectBasedTestResult(child->node(), request, locationInContainer))
-                    return true;
+            for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
+                // FIXME: nodeAtFloatPoint() doesn't handle rect-based hit tests yet.
+                if (child->nodeAtFloatPoint(request, result, localPoint, hitTestAction)) {
+                    updateHitTestResult(result, pointInBorderBox);
+                    if (!result.addNodeToRectBasedTestResult(child->node(), request, locationInContainer))
+                        return true;
+                }
             }
         }
     }
 
     // If we didn't early exit above, we've just hit the container <svg> element. Unlike SVG 1.1, 2nd Edition allows container elements to be hit.
     if ((hitTestAction == HitTestBlockBackground || hitTestAction == HitTestChildBlockBackground) && visibleToHitTestRequest(request)) {
         // Only return true here, if the last hit testing phase 'BlockBackground' (or 'ChildBlockBackground' - depending on context) is executed.
         // If we'd return true in the 'Foreground' phase, hit testing would stop immediately. For SVG only trees this doesn't matter.
         // Though when we have a <foreignObject> subtree we need to be able to detect hits on the background of a <div> element.
         // If we'd return true here in the 'Foreground' phase, we are not able to detect these hits anymore.
         LayoutRect boundsRect(accumulatedOffset + location(), size());
         if (locationInContainer.intersects(boundsRect)) {
             updateHitTestResult(result, pointInBorderBox);
             if (!result.addNodeToRectBasedTestResult(node(), request, locationInContainer, boundsRect))
                 return true;
         }
     }
 
     return false;
 }
 
 }