Steps to reproduce: When compiling Firefox with cfi-derived-cast, crashtest layout/svg/crashtests/267650-1.svg fails due to the downcasting here: https://searchfox.org/mozilla-central/rev/daf613efc5c358f3a94961d73b90472c00703 838/layout/svg/SVGUtils.cpp#1525 The dynamic type of `aFrame->GetContent()` is `nsTextNode`, which is not derived from `SVGElement`. This might not be s-s, just flagging as a precaution.
Bug 1811464 Comment 0 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Steps to reproduce: When compiling Firefox with cfi-derived-cast, crashtest layout/svg/crashtests/267650-1.svg fails due to the downcasting here: https://searchfox.org/mozilla-central/rev/daf613efc5c358f3a94961d73b90472c00703838/layout/svg/SVGUtils.cpp#1525 The dynamic type of `aFrame->GetContent()` is `nsTextNode`, which is not derived from `SVGElement`. This might not be s-s, just flagging as a precaution.