Bug 1185266 - Look up painting properties on the SVGTextFrame when painting text frames that are direct children of <text>. r=jwatt

layout/reftests/bugs/1185266-1-ref.svg

@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <style>
+    text { fill: url(#green); }
+  </style>
+  <linearGradient id="green">
+    <stop stop-color="green"/>
+  </linearGradient>
+  <text x="10" y="20">This text must be green.</text>
+</svg>

layout/reftests/bugs/1185266-1.svg

@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+  <style>
+    g { fill: url(#red); }
+    g.x { fill: url(#green); }
+  </style>
+  <linearGradient id="red">
+    <stop stop-color="red"/>
+  </linearGradient>
+  <linearGradient id="green">
+    <stop stop-color="green"/>
+  </linearGradient>
+  <g>
+    <text x="10" y="20">This text must be green.</text>
+  </g>
+  <script>
+    function run() {
+      var g = document.querySelector("g");
+      g.setAttribute("class", "x");
+      document.documentElement.removeAttribute("class");
+    }
+    document.addEventListener("MozReftestInvalidate", run, false);
+  </script>
+</svg>

layout/svg/nsSVGEffects.cpp

@@ -572,8 +572,18 @@ nsSVGEffects::GetPaintServer(nsIFrame *aTargetFrame, const nsStyleSVGPaint *aPai
   if (aPaint->mType != eStyleSVGPaintType_Server)
     return nullptr;
 
-  nsIFrame *frame = aTargetFrame->GetContent()->IsNodeOfType(nsINode::eTEXT) ?
-                      aTargetFrame->GetParent() : aTargetFrame;
+  // If we're looking at a frame within SVG text, then we need to look up
+  // to find the right frame to get the painting property off.  We should at
+  // least look up past a text frame, and if the text frame's parent is the
+  // anonymous block frame, then we look up to its parent (the SVGTextFrame).
+  nsIFrame* frame = aTargetFrame;
+  if (frame->GetContent()->IsNodeOfType(nsINode::eTEXT)) {
+    frame = frame->GetParent();
+    nsIFrame* grandparent = frame->GetParent();
+    if (grandparent && grandparent->GetType() == nsGkAtoms::svgTextFrame) {
+      frame = grandparent;
+    }
+  }
   nsSVGPaintingProperty *property =
     nsSVGEffects::GetPaintingProperty(aPaint->mPaint.mPaintServer, frame, aType);
   if (!property)