897384 - "ASSERTION: Abs pos whose parent is not the abs pos containing block?" and crash with SVG requiredFeatures, foreignObject

Status: RESOLVED DUPLICATE of bug 1182496

(Core :: SVG, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: Abs pos whose parent is not the abs pos containing block?: 'aNewFrame->GetParent() == mAbsoluteItems.containingBlock', file layout/base/nsCSSFrameConstructor.cpp, line 1165

###!!! ASSERTION: unknown out of flow frame type: 'disp->mDisplay == NS_STYLE_DISPLAY_POPUP', file layout/generic/nsHTMLReflowState.cpp, line 679

With a more complicated testcase, it can also crash (frame poisoning).

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Daniel Holbert [:dholbert]]

Testcase loads just fine in an up-to-date debug build. (No assertions, no crash.)

I think this is a dupe of bug 1182496 (which was recently fixed).  (Bug 1182496's reduced testcase, attachment 8633672 [details], triggered the same assertions in comment 0 here -- see bug 1182496 comment 4 -- and it looks like a "more complicated" version of the testcase here, and it did indeed crash w/ frame poisoning as Jesse foretold in comment 0.)