Other svg elements works. Only text not (and tspan inside it).

Bisected to d44cc5eb0dd3240a5feef91f4ec09b5ae1ac5e5c = https://crrev.com/1870983002 by fs@opera.com
"Only hit-test SVG <text> foreground"
Landed in 52.0.2705.0

Repro: the attached test.html
Expected: "text" element is found by both elementsFromPoint and elementFromPoint
Observed: "text" element is not found by elementsFromPoint, only by elementFromPoint

Judging by the discrepancy in output between elementsFromPoint and elementFromPoint, the observed behavior definitely looks like a bug.

Deleted: test.html 717 bytes

test.html 717 bytes View Download

Deleted: r386307 good.png 9.2 KB

	r386307 good.png 9.2 KB View Download

Deleted: r386308 bad.png 6.4 KB

	r386308 bad.png 6.4 KB View Download

Able to reproduce the issue on chrome reported version 66.0.3359.139 and latest stable# 66.0.3359.170 using Windows-10, Mac 10.12.6 and Ubuntu 14.04 with the "test.html" file provided in comment#2. As the issue is seen from M-60(60.0.3112.0), hence considering this issue as Non-Regression and marking it as Untriaged.
Note: As per comment#2, CC'ing fs@opera.com for further inputs on this issue.

Thanks!

++ to comment-4: Issue is also seen on latest chrome version# 68.0.3430.0.

elementsFromPoint doesn't "remap" Text nodes to their ancestor like elementFromPoint does. Based on the bisect data it'd seem that maybe we'd use to hit that ancestor node (the <text>) during the background pass previously, and things panned out... Reverting that condition now though doesn't seem to help, so something else seems amiss. (My guess would be the <slot> "handling", which I don't quite understand what it's trying to achieve.)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9bb752c62627ce6584b6834d4f9e3ad0ed303a78

commit 9bb752c62627ce6584b6834d4f9e3ad0ed303a78
Author: Fredrik Söderquist <fs@opera.com>
Date: Wed May 23 20:06:23 2018

Reverse traversal order in SVGRootInlineBox

Text painted later should make the top-most node, so line boxes should
be visited front-to-back. This will generally only make a difference for
text nodes that overlap.

This will also make a difference when elementsFromPoint is fixed, since
then we'll add the hit elements in the required "innermost to outermost"
order.

Bug:  842504 
Change-Id: I541a394cbb0677980308615793f5e1fa9ea3b401
Reviewed-on: https://chromium-review.googlesource.com/1070196
Commit-Queue: Fredrik Söderquist <fs@opera.com>
Reviewed-by: Stephen Chenney <schenney@chromium.org>
Reviewed-by: Philip Rogers <pdr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#561222}
[add] https://crrev.com/9bb752c62627ce6584b6834d4f9e3ad0ed303a78/third_party/WebKit/LayoutTests/svg/hittest/text-overlapped.html
[modify] https://crrev.com/9bb752c62627ce6584b6834d4f9e3ad0ed303a78/third_party/blink/renderer/core/layout/svg/line/svg_root_inline_box.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f6a6b6501a577ddd297b73a4f7bdc8308465ac98

commit f6a6b6501a577ddd297b73a4f7bdc8308465ac98
Author: Fredrik Söderquist <fs@opera.com>
Date: Wed May 23 20:38:38 2018

Allow Text node in elementsFromPoint if descendant of SVG text content

When hit-testing, SVG text content nodes will use their Text node
descendants as the inner-most/hit node, and hit-testing will not be
performed in any of the background phases. Thus we need to selectively
allow Text node which has an SVG text content element as their parent.

Bug:  842504 
Change-Id: Ie282d5e9a66880f3f0d5e319b249f5f41db9e9db
Reviewed-on: https://chromium-review.googlesource.com/1059753
Commit-Queue: Fredrik Söderquist <fs@opera.com>
Reviewed-by: Philip Rogers <pdr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#561238}
[add] https://crrev.com/f6a6b6501a577ddd297b73a4f7bdc8308465ac98/third_party/WebKit/LayoutTests/external/wpt/css/cssom-view/elementsFromPoint-svg-text.html
[modify] https://crrev.com/f6a6b6501a577ddd297b73a4f7bdc8308465ac98/third_party/blink/renderer/core/dom/tree_scope.cc