This avoids a crash that occurred when calling `getBBox()` on an SVG
element that had a transform with no inverse.
Found by Domato.
(cherry picked from commit d417b7568360f20487e4182e52872b82c8fbbf60)
Since SVG gradients can reference each other, we have to keep track of
visited gradients when traversing the link chain, or we will recurse
infinitely when there's a reference cycle.
This attribute has some compatbility issues...
- The spec says it should be an SVGAnimatedRect which contains
a DOMRect and a DOMReadOnlyRect.
- Blink gives you an SVGAnimatedRect with 2x SVGRect
- Gecko gives you an SVGAnimatedRect with 2x SVGRect? (nullable)
I ended up with something similar to Gecko, an SVGAnimatedRect
with 2x DOMRect? (nullable)
With this fixed, we can now load https://polar.sh/ :^)
It does not currently handle any of the actual scripting, but this
should at least allow us to create an instance of the element.
The test being added here isn't actually testing much, but before the
previous commit we used to crash parsing the page due to a TODO().
