[SVG] Reject hit-test queries when the element has a singular transform
When an SVG element was affected by a transform that was singular,
AffineTransform::inverse() would return the identity transform, and the
query point would not actually be transformed to the local user-space.
Make sure all calls to said method is guarded by a check to
AffineTransform::isInvertible(), and fail the hit-test if it returns false.
Add a new SVGRenderSupport-helper that does the point-transformation and
checks against the clipping area, since this is a recurring pattern in
various implementations of RenderSVG*::nodeAtFloatPoint.
RenderSVGRoot has the logic added, but still does not reject queries. This
is due to special-case handling of empty viewBoxes in
SVGFitToViewBox::viewBoxToViewTransform.
BUG=395675
Review URL: https://codereview.chromium.org/411613002
git-svn-id: svn://svn.chromium.org/blink/trunk@178745 bbb929c8-8fbe-4397-9dbb-9b2b20218538
23 files changed
