From 801499f13ee0fa942bdf43522732a63e78a90513 Mon Sep 17 00:00:00 2001
From: Psychpsyo <psychpsyo@gmail.com>
Date: Sat, 16 Nov 2024 14:46:51 +0100
Subject: [PATCH] LibWeb: Fix crash from text inside SVG

---
 Libraries/LibWeb/Painting/SVGSVGPaintable.cpp | 4 ++--
 Tests/LibWeb/Ref/input/svg-text-crash.html    | 7 +++++++
 2 files changed, 9 insertions(+), 2 deletions(-)
 create mode 100644 Tests/LibWeb/Ref/input/svg-text-crash.html

diff --git a/Libraries/LibWeb/Painting/SVGSVGPaintable.cpp b/Libraries/LibWeb/Painting/SVGSVGPaintable.cpp
index 1020b57c12d..7d782e4aa0b 100644
--- a/Libraries/LibWeb/Painting/SVGSVGPaintable.cpp
+++ b/Libraries/LibWeb/Painting/SVGSVGPaintable.cpp
@@ -100,8 +100,8 @@ void SVGSVGPaintable::paint_descendants(PaintContext& context, PaintableBox cons
     };
 
     paintable.before_children_paint(context, PaintPhase::Foreground);
-    paintable.for_each_child([&](auto& child) {
-        paint_svg_box(verify_cast<PaintableBox>(child));
+    paintable.for_each_child_of_type<PaintableBox>([&](PaintableBox& child) {
+        paint_svg_box(child);
         return IterationDecision::Continue;
     });
     paintable.after_children_paint(context, PaintPhase::Foreground);
diff --git a/Tests/LibWeb/Ref/input/svg-text-crash.html b/Tests/LibWeb/Ref/input/svg-text-crash.html
new file mode 100644
index 00000000000..5e409546230
--- /dev/null
+++ b/Tests/LibWeb/Ref/input/svg-text-crash.html
@@ -0,0 +1,7 @@
+<!-- matches against itself because the only thing being tested is that this does not crash. -->
+<link rel="match" href="./svg-text-crash.html" />
+<svg>
+    <foreignObject>
+        <span>foo</span>
+    </foreignObject>
+</svg>