1250725 - Assertion failure: "Someone passed native anonymous content directly into frame construction. Stop doing that!"

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Assertion failure: aChild->GetProperty(nsGkAtoms::restylableAnonymousNode) (Someone passed native anonymous content directly into frame construction.  Stop doing that!), at layout/base/nsCSSFrameConstructor.cpp:6654

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I also see this assertion loading https://drafts.csswg.org/css-values-3/ , but it's not clear if it's the same cause as this bug.  This is one of my more common crashes in debug builds.

Comment 3

[Boris Zbarsky [:bzbarsky]]

The assert on this bug's testcase is due to reframe targeting the <svg:svg> inside the <svg:use>.  That one is just a straightforward bug in the changes bug 1177819 made to SVGUseElement::CreateAnonymousContent which I'll attach a patch for...

The assert on https://drafts.csswg.org/css-values-3/ is due to a reframe targeting the anonymous <xul:scrollcorner> inside the scrollframe of an HTML <details> element.  It's not obvious to me why we have such a thing yet.  I filed bug 1297835 on that.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: Correctly flag the <svg:svg> we synthesize when <svg:use> references a <svg:symbol> as allowed to be reframed

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ae49b3387b38
Correctly flag the <svg:svg> we synthesize when <svg:use> references a <svg:symbol> as allowed to be reframed.  r=dbaron

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ae49b3387b38