bug 445687 - Should not be able to nest text r+sr=roc

layout/base/nsCSSFrameConstructor.cpp

@@ -7144,7 +7144,14 @@ nsCSSFrameConstructor::ConstructSVGFrame(nsFrameConstructorState& aState,
     newFrame = NS_NewSVGAFrame(mPresShell, aContent, aStyleContext);
   }
   else if (aTag == nsGkAtoms::text) {
-    newFrame = NS_NewSVGTextFrame(mPresShell, aContent, aStyleContext);
+    nsIFrame *ancestorFrame = SVG_GetFirstNonAAncestorFrame(aParentFrame);
+    if (ancestorFrame) {
+      nsISVGTextContentMetrics* metrics;
+      CallQueryInterface(ancestorFrame, &metrics);
+      // Text cannot be nested
+      if (!metrics)
+        newFrame = NS_NewSVGTextFrame(mPresShell, aContent, aStyleContext);
+    }
   }
   else if (aTag == nsGkAtoms::tspan) {
     nsIFrame *ancestorFrame = SVG_GetFirstNonAAncestorFrame(aParentFrame);

layout/reftests/svg/invalid-text-01.svg

@@ -0,0 +1,15 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/licenses/publicdomain/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" version="1.1">
+
+  <title>Testcase for invalid text</title>
+
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=445687 -->
+
+  <rect width="100%" height="100%" fill="lime"/>
+
+  <text x="50" y="50" font-size="30"><tspan><text x="50" y="50" font-size="30">Should not see this</text></tspan></text>
+
+</svg>

layout/reftests/svg/reftest.list

@@ -46,6 +46,7 @@ include moz-only/reftest.list
 fails == inline-in-xul-basic-01.xul pass.svg
 == image-scaling-01.svg pass.svg
 == image-scaling-02.svg pass.svg
+== invalid-text-01.svg pass.svg
 == linearGradient-basic-01.svg pass.svg
 == linearGradient-basic-02.svg pass.svg
 == nested-viewBox-01.svg pass.svg