Jesse Ruderman Reporter
	Description • 9 years ago

Assertion failure: aChild->GetProperty(nsGkAtoms::restylableAnonymousNode) (Someone passed native anonymous content directly into frame construction.  Stop doing that!), at layout/base/nsCSSFrameConstructor.cpp:6654

	David Baron :dbaron:
	Comment 2 • 8 years ago

I also see this assertion loading https://drafts.csswg.org/css-values-3/ , but it's not clear if it's the same cause as this bug.  This is one of my more common crashes in debug builds.

	Boris Zbarsky [:bzbarsky] Assignee
	Comment 3 • 8 years ago

The assert on this bug's testcase is due to reframe targeting the <svg:svg> inside the <svg:use>.  That one is just a straightforward bug in the changes bug 1177819 made to SVGUseElement::CreateAnonymousContent which I'll attach a patch for...

The assert on https://drafts.csswg.org/css-values-3/ is due to a reframe targeting the anonymous <xul:scrollcorner> inside the scrollframe of an HTML <details> element.  It's not obvious to me why we have such a thing yet.  I filed bug 1297835 on that.

	Pulsebot
	Comment 5 • 8 years ago

Pushed by bzbarsky@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ae49b3387b38
Correctly flag the <svg:svg> we synthesize when <svg:use> references a <svg:symbol> as allowed to be reframed.  r=dbaron

	Ryan VanderMeulen [:RyanVM]
	Comment 6 • 8 years ago
bugherder

https://hg.mozilla.org/mozilla-central/rev/ae49b3387b38