Cherry-pick 282651@main (bdbc424). https://bugs.webkit.org/show_bug.cgi?id=277624

    REGRESSION (269500@main Safari 17.5): Masked Curved Line Rendering Issue
    https://bugs.webkit.org/show_bug.cgi?id=277624
    rdar://133251058

    Reviewed by Cameron McCormack.

    SVG mask implementation is incorrectly mixing repaint rect and bounding box.
    We workaround the issue by passing RepaintRectCalculation::Accurate to enforce
    child renderers to compute bounding boxes. But the right implementation should
    distinguish repaint rect and bounding box as repaint rect is just used for
    invalidation.

    * LayoutTests/svg/masking/masker-mixing-repaint-rect-and-bounding-box-expected.html: Added.
    * LayoutTests/svg/masking/masker-mixing-repaint-rect-and-bounding-box.html: Added.
    * Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp:
    (WebCore::RenderSVGResourceMasker::applyMask):
    * Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceGradient.cpp:
    (WebCore::createMaskAndSwapContextForTextGradient):
    (WebCore::clipToTextMask):
    * Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceMasker.cpp:
    (WebCore::LegacyRenderSVGResourceMasker::applyResource):

    Canonical link: https://commits.webkit.org/282651@main

Canonical link: https://commits.webkit.org/282416.60@webkitglib/2.46

Author: Constellation

LayoutTests/svg/masking/masker-mixing-repaint-rect-and-bounding-box-expected.html

@@ -0,0 +1,15 @@
+<style>
+  .line {
+    overflow: visible;
+    stroke: red;
+  }
+</style>
+
+<svg class="line" style="top: 50px; left: 50px;">
+  <g>
+    <path
+      d="M3,440.1129 C191,-140.0679 270,-141.36806 240,436.2124"
+      stroke-linecap="butt" stroke-width="8" fill="none"
+    />
+  </g>
+</svg>

LayoutTests/svg/masking/masker-mixing-repaint-rect-and-bounding-box.html

@@ -0,0 +1,21 @@
+<meta name="fuzzy" content="maxDifference=0-70; totalPixels=0-401" />
+<style>
+  .line {
+    overflow: visible;
+    stroke: red;
+  }
+</style>
+
+<svg class="line" style="top: 50px; left: 50px;">
+  <defs>
+    <mask id="__id121" maskUnits="userSpaceOnUse" x="-8" y="-8" width="266" height="457">
+      <rect x="-8" y="-8" width="266" height="457" fill="white"/>
+    </mask>
+  </defs>
+  <g>
+    <path mask="url(#__id121)"
+      d="M3,440.1129 C191,-140.0679 270,-141.36806 240,436.2124"
+      stroke-linecap="butt" stroke-width="8" fill="none"
+    />
+  </g>
+</svg>

Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp

@@ -97,7 +97,9 @@ void RenderSVGResourceMasker::applyMask(PaintInfo& paintInfo, const RenderLayerM
     if (!coordinateSystemOriginTranslation.isZero())
         context.translate(coordinateSystemOriginTranslation);
 
-    auto repaintBoundingBox = targetRenderer.repaintRectInLocalCoordinates();
+    // FIXME: This needs to be bounding box and should not use repaint rect.
+    // https://bugs.webkit.org/show_bug.cgi?id=278551
+    auto repaintBoundingBox = targetRenderer.repaintRectInLocalCoordinates(RepaintRectCalculation::Accurate);
     auto absoluteTransform = context.getCTM(GraphicsContext::DefinitelyIncludeDeviceScale);
 
     auto maskColorSpace = DestinationColorSpace::SRGB();

Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceGradient.cpp

@@ -63,7 +63,9 @@ static inline bool createMaskAndSwapContextForTextGradient(GraphicsContext*& con
     ASSERT(textRootBlock);
 
     AffineTransform absoluteTransform = SVGRenderingContext::calculateTransformationToOutermostCoordinateSystem(*textRootBlock);
-    FloatRect repaintRect = textRootBlock->repaintRectInLocalCoordinates();
+    // FIXME: This needs to be bounding box and should not use repaint rect.
+    // https://bugs.webkit.org/show_bug.cgi?id=278551
+    FloatRect repaintRect = textRootBlock->repaintRectInLocalCoordinates(RepaintRectCalculation::Accurate);
 
     // Ignore 2D rotation, as it doesn't affect the size of the mask.
     FloatSize scale(absoluteTransform.xScale(), absoluteTransform.yScale());
@@ -90,7 +92,9 @@ static inline AffineTransform clipToTextMask(GraphicsContext& context, RefPtr<Im
 
     AffineTransform absoluteTransform = SVGRenderingContext::calculateTransformationToOutermostCoordinateSystem(*textRootBlock);
 
-    targetRect = textRootBlock->repaintRectInLocalCoordinates();
+    // FIXME: This needs to be bounding box and should not use repaint rect.
+    // https://bugs.webkit.org/show_bug.cgi?id=278551
+    targetRect = textRootBlock->repaintRectInLocalCoordinates(RepaintRectCalculation::Accurate);
 
     // Ignore 2D rotation, as it doesn't affect the size of the mask.
     FloatSize scale(absoluteTransform.xScale(), absoluteTransform.yScale());

Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceMasker.cpp

@@ -68,7 +68,9 @@ auto LegacyRenderSVGResourceMasker::applyResource(RenderElement& renderer, const
 
     MaskerData* maskerData = m_masker.get(renderer);
     AffineTransform absoluteTransform = SVGRenderingContext::calculateTransformationToOutermostCoordinateSystem(renderer);
-    FloatRect repaintRect = renderer.repaintRectInLocalCoordinates();
+    // FIXME: This needs to be bounding box and should not use repaint rect.
+    // https://bugs.webkit.org/show_bug.cgi?id=278551
+    FloatRect repaintRect = renderer.repaintRectInLocalCoordinates(RepaintRectCalculation::Accurate);
 
     // Ignore 2D rotation, as it doesn't affect the size of the mask.
     FloatSize scale(absoluteTransform.xScale(), absoluteTransform.yScale());