commit 5849cae3c486d99ceafd1f362e18c828b05971ae
author commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Fri Feb 28 16:35:27 2014 +0000
committer commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Fri Feb 28 16:35:27 2014 +0000
tree f0a6d050050cd511b7134b4b37fe65eaa5f48255
parent 17e1718776f1419634c0eefb952f2066857b94a4

ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result) in WebCore::RenderGeometryMap::mapToContainer
https://bugs.webkit.org/show_bug.cgi?id=119626

Source/WebCore:

SVGRenderSupport::mapLocalToContainer() was trying to apply transforms
in the incorrect order. Specifically, it would attempt to apply its
localToParentTransform before its localToBorderBoxTransform. This
was causing an ASSERT to fail when the computed transforms didn't
match up to those computed by RenderGeometryMap.

Backported from Blink: https://codereview.chromium.org/143363004

Patch by Martin Hodovan <mhodovan@inf.u-szeged.hu> on 2014-02-28
Reviewed by Simon Fraser.

Test: svg/transforms/svg-geometry-crash.html

* rendering/svg/SVGRenderSupport.cpp:
(WebCore::SVGRenderSupport::mapLocalToContainer):

LayoutTests:

Backported from Blink: https://codereview.chromium.org/143363004

Patch by Martin Hodovan <mhodovan@inf.u-szeged.hu> on 2014-02-28
Reviewed by Simon Fraser.

* svg/transforms/svg-geometry-crash-expected.txt: Added.
* svg/transforms/svg-geometry-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@164861 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/rendering/svg/SVGRenderSupport.cpp

diff --git a/Source/WebCore/rendering/svg/SVGRenderSupport.cpp b/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
index af2d76c..f324a58 100644
--- a/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
+++ b/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
@@ -83,8 +83,6 @@
 
 void SVGRenderSupport::mapLocalToContainer(const RenderElement& renderer, const RenderLayerModelObject* repaintContainer, TransformState& transformState, bool* wasFixed)
 {
-    transformState.applyTransform(renderer.localToParentTransform());
-
     ASSERT(renderer.parent());
     auto& parent = *renderer.parent();
     
@@ -94,6 +92,8 @@
     if (parent.isSVGRoot())
         transformState.applyTransform(toRenderSVGRoot(parent).localToBorderBoxTransform());
 
+    transformState.applyTransform(renderer.localToParentTransform());
+
     MapCoordinatesFlags mode = UseTransforms;
     parent.mapLocalToContainer(repaintContainer, transformState, mode, wasFixed);
 }