Bug 1402798 - Part 1. Check the type of an SVGPaint object from the correct frame. r=longsonr+218550

mTargetFrame is not a correct one, we should check the SVGStyle of 'frame'
object.

MozReview-Commit-ID: 3UNfbXkICkz

--HG--
extra : amend_source : 9fa5f095881fc3b92329a7d187f4d5926c43fed7

layout/svg/SVGObserverUtils.cpp

@@ -631,10 +631,6 @@ SVGObserverUtils::GetPaintServer(nsIFrame* aTargetFrame,
                                  nsStyleSVGPaint nsStyleSVG::* aPaint,
                                  PaintingPropertyDescriptor aType)
 {
-  const nsStyleSVG* svgStyle = aTargetFrame->StyleSVG();
-  if ((svgStyle->*aPaint).Type() != eStyleSVGPaintType_Server)
-    return nullptr;
-
   // If we're looking at a frame within SVG text, then we need to look up
   // to find the right frame to get the painting property off.  We should at
   // least look up past a text frame, and if the text frame's parent is the
@@ -648,6 +644,10 @@ SVGObserverUtils::GetPaintServer(nsIFrame* aTargetFrame,
     }
   }
 
+  const nsStyleSVG* svgStyle = frame->StyleSVG();
+  if ((svgStyle->*aPaint).Type() != eStyleSVGPaintType_Server)
+    return nullptr;
+
   nsCOMPtr<nsIURI> paintServerURL =
     SVGObserverUtils::GetPaintURI(frame, aPaint);
   nsSVGPaintingProperty *property =