[SVG] Reject hit-test queries when the element has a singular transform

Source/core/rendering/svg/RenderSVGShape.cpp

 /*
  * Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2008 Rob Buis <buis@kde.org>
  * Copyright (C) 2005, 2007 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Google, Inc.
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  * Copyright (C) 2009 Jeff Schiller <codedread@gmail.com>
  * Copyright (C) 2011 Renata Hodovan <reni@webkit.org>
  * Copyright (C) 2011 University of Szeged
@@ skipping 284 matching lines @@
     if (!rect.isEmpty())
         rects.append(rect);
 }
 
 bool RenderSVGShape::nodeAtFloatPoint(const HitTestRequest& request, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
 {
     // We only draw in the foreground phase, so we only hit-test then.
     if (hitTestAction != HitTestForeground)
         return false;
 
-    FloatPoint localPoint = m_localTransform.inverse().mapPoint(pointInParent);
-
-    if (!SVGRenderSupport::pointInClippingArea(this, localPoint))
+    FloatPoint localPoint;
+    if (!SVGRenderSupport::transformToUserSpaceAndCheckClipping(this, m_localTransform, pointInParent, localPoint))
         return false;
 
     PointerEventsHitRules hitRules(PointerEventsHitRules::SVG_GEOMETRY_HITTESTING, request, style()->pointerEvents());
     if (nodeAtFloatPointInternal(request, localPoint, hitRules)) {
         updateHitTestResult(result, roundedLayoutPoint(localPoint));
         return true;
     }
 
     return false;
 }
@@ skipping 135 matching lines @@
         return;
 
     ASSERT(m_path);
 
     SVGMarkerData markerData(m_markerPositions);
     m_path->apply(&markerData, SVGMarkerData::updateFromPathElement);
     markerData.pathIsDone();
 }
 
 }