Created attachment 342956 [details] testcase (crashes Firefox when loaded) ###!!! ASSERTION: null nsSVGPathGeometry frame: 'mMarkedFrame', file layout/svg/base/src/nsSVGMarkerFrame.cpp, line 112 Crash [@ nsSVGMarkerFrame::GetCanvasTM] (nsSVGMarkerFrame.cpp:114)
I don't see how we can possibly assert that mMarkedFrame is non-null here. What's making sure it is?
Created attachment 343119 [details] [diff] [review] patch The assert is valid, we need to protect ourselves from trying to determine the covered region of something that isn't drawn directly like the contents of a marker.
checked in 17e8145c4996
verified fixed using Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b2pre) Gecko/20081017 Minefield/3.1b2pre and Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b2pre) Gecko/20081017 Minefield/3.1b2pre.
verified fixed on the 1.9.1 branch using Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b3pre) Gecko/20090106 Shiretoko/3.1b3pre and the equivalent Mac build. adding verified keyword.