Created attachment 610718 [details] testcase ###!!! ASSERTION: viewport height must be nonnegative!: 'aViewportHeight >= 0', file layout/svg/base/src/nsSVGUtils.cpp, line 957
I think nsSVGPatternFrame::GetPatternRect should be indicating there's an error if width="" or height="" is <= 0 and cause the pattern not to render (and causing a fallback colour to be used if one was specified?).
Although maybe if width/height == 0 nothing should be painted, while if it's <= 0 we should fall back.
Created attachment 610882 [details] [diff] [review] patch
Comment on attachment 610882 [details] [diff] [review] patch Might be good to add a second crashtest 740627-2.svg with width="-65%" (instead of height) In any case, looks great -- r=me
Ms2ger backed out for burning the tree (in https://hg.mozilla.org/integration/mozilla-inbound/rev/2195f743e7dc), but now believed to be delayed bustage from a prior landing. Can reland once the tree is green (but may be after I am afk, so posting this in case I'm not able to reland for you); sorry for the hassle.
Thank you for relanding.
No problem :-) https://hg.mozilla.org/mozilla-central/rev/8f77f15134c2