Bug 1696505 - stop SVG text reflows triggering other reflows r=jwatt

Differential Revision: https://phabricator.services.mozilla.com/D158912

layout/svg/SVGObserverUtils.cpp

@@ -530,6 +530,9 @@ void SVGMarkerObserver::OnRenderingChange() {
   MOZ_ASSERT(frame->IsFrameOfType(nsIFrame::eSVG), "SVG frame expected");
 
   // Don't need to request ReflowFrame if we're being reflowed.
+  // Because mRect for SVG frames includes the bounds of any markers
+  // (see the comment for nsIFrame::GetRect), the referencing frame must be
+  // reflowed for any marker changes.
   if (!frame->HasAnyStateBits(NS_FRAME_IN_REFLOW)) {
     // XXXjwatt: We need to unify SVG into standard reflow so we can just use
     // nsChangeHint_NeedReflow | nsChangeHint_NeedDirtyReflow here.

layout/svg/SVGTextFrame.cpp

@@ -2848,12 +2848,6 @@ void SVGTextFrame::ReflowSVGNonDisplayText() {
   // time it is painted, we reflow the anonymous block frame.
   this->MarkSubtreeDirty();
 
-  // We also need to call InvalidateRenderingObservers, so that if the <text>
-  // element is within a <mask>, say, the element referencing the <mask> will
-  // be updated, which will then cause this SVGTextFrame to be painted and
-  // in doing so cause the anonymous block frame to be reflowed.
-  SVGObserverUtils::InvalidateRenderingObservers(this);
-
   // Finally, we need to actually reflow the anonymous block frame and update
   // mPositions, in case we are being reflowed immediately after a DOM
   // mutation that needs frame reconstruction.

layout/svg/crashtests/1696505.html

@@ -0,0 +1,9 @@
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+    document.getElementById('a').style.cssText += "grid-row-end:auto"
+})
+</script>
+<svg>
+<polyline marker-mid='url(#a)'/>
+<marker id='a'>
+<text/>

layout/svg/crashtests/crashtests.list

@@ -239,6 +239,7 @@ load 1609663.html
 skip-if(Android) load 1671950.html # No print-preview support on android
 load 1678947.html
 load 1693032.html
+load 1696505.html
 load 1758029-1.html
 HTTP load 1755770-1.html
 HTTP load 1755770-2.html