Created attachment 715552 [details] testcase (crashes Firefox when loaded) With: user_pref("svg.text.css-frames.enabled", true); the testcase causes an OOB array access in nsSVGTextFrame2::ResolvePositions, which is reported as: Assertion failure: i < Length() (invalid array index), at nsTArray.h:632
Attachment #728767 - Flags: review?(cam) → review+
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla22
You need to log in before you can comment on or make changes to this bug.