###!!! ASSERTION: reflow state made child wrong size: 'reflowState.ComputedWidth() == mRect.width', file layout/svg/nsSVGForeignObjectFrame.cpp, line 553

Testcase requires: user_pref("layout.css.vertical-text.enabled", true);

It doesn't just trip an assertion, it also renders incorrectly (if there's any actual content to render).

Here's a simple reftest that renders incorrectly (when writing-mode is enabled) until the bug is fixed.

If the pref can be changed during a session, you can force it on for a specific reftest, like this: > pref(layout.css.vertical-text.enabled,true) == foreignObject-vertical-01.svg foreignObject-vertical-01-ref.svg

Comment on attachment 8582357 [details] [diff] [review] Fix sizing of foreignObject with vertical writing mode Review of attachment 8582357 [details] [diff] [review]: ----------------------------------------------------------------- ::: layout/svg/nsSVGForeignObjectFrame.cpp @@ +548,5 @@ > NS_ASSERTION(reflowState.ComputedPhysicalBorderPadding() == nsMargin(0, 0, 0, 0) && > reflowState.ComputedPhysicalMargin() == nsMargin(0, 0, 0, 0), > "style system should ensure that :-moz-svg-foreign-content " > "does not get styled"); > + NS_ASSERTION(reflowState.ComputedISize() == GetLogicalSize(wm).ISize(wm), reflowState.ComputedISize() == ISize(wm) @@ +553,2 @@ > "reflow state made child wrong size"); > + reflowState.SetComputedBSize(GetLogicalSize(wm).BSize(wm)); reflowState.SetComputedBSize(BSize(wm));

https://hg.mozilla.org/integration/mozilla-inbound/rev/55df5a95d7df https://hg.mozilla.org/integration/mozilla-inbound/rev/4a966d61821b

https://hg.mozilla.org/mozilla-central/rev/55df5a95d7df https://hg.mozilla.org/mozilla-central/rev/4a966d61821b