Merge 104328 - [CSSRegions]Crash while collecting svg elements in render flow thread.

Source/WebCore/dom/NodeRenderingContext.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 18 matching lines @@
 #include "ContainerNode.h"
 #include "Node.h"
 #include "RenderFlowThread.h"
 #include "RenderFullScreen.h"
 #include "RenderObject.h"
 #include "RenderView.h"
 #include "ShadowContentElement.h"
 #include "ShadowInclusionSelector.h"
 #include "ShadowRoot.h"
 
+#if ENABLE(SVG)
+#include "SVGNames.h"
+#endif
+
 namespace WebCore {
 
 NodeRenderingContext::NodeRenderingContext(Node* node)
     : m_location(LocationNotInTree)
     , m_phase(AttachStraight)
     , m_node(node)
     , m_parentNodeForRenderingAndStyle(0)
     , m_visualParentShadowRoot(0)
     , m_includer(0)
     , m_style(0)
@@ skipping 221 matching lines @@
         return false;
 
     return true;
 }
 
 void NodeRenderingContext::moveToFlowThreadIfNeeded()
 {
     if (!m_node->isElementNode() || !m_style || m_style->flowThread().isEmpty())
         return;
 
+#if ENABLE(SVG)
+    // Allow only svg root elements to be directly collected by a render flow thread.
+    if (m_node->isSVGElement()
+        && (!(m_node->hasTagName(SVGNames::svgTag) && m_node->parentNode() && !m_node->parentNode()->isSVGElement())))
+        return;
+#endif
+
     m_flowThread = m_style->flowThread();
     ASSERT(m_node->document()->renderView());
     m_parentFlowRenderer = m_node->document()->renderView()->renderFlowThreadWithName(m_flowThread);
 }
 
 NodeRendererFactory::NodeRendererFactory(Node* node)
     : m_context(node)
 {
 }
 
@@ skipping 54 matching lines @@
 #endif
 
     if (!newRenderer)
         return;
 
     // Note: Adding newRenderer instead of renderer(). renderer() may be a child of newRenderer.
     parentRenderer->addChild(newRenderer, nextRenderer);
 }
 
 }