###!!! ASSERTION: must have root frame: '!aFrame->GetParent()', file layout/base/nsLayoutUtils.cpp, line 1274

That looks like a bogus assert to me... In this case we're doing a RenderDocument for svg-as-image, which sets the "ignore scrolling" flag on the presshell, but then the foreignObject calls PaintFrame under there...

One other odd thing here... So at first I was confused about where "SVG-as-image" was coming into play here, and why "url(#b)" wasn't just ignored since there's no element with id="b". It's because url(#b) resolves to: https://bugzilla.mozilla.org/attachment.cgi?id=480661#b which ends up being the same as https://bugzilla.mozilla.org/attachment.cgi?id=480661 (Similarly, the commands curl https://bugzilla.mozilla.org/attachment.cgi?id=480661#b firefox https://bugzilla.mozilla.org/attachment.cgi?id=480661#b both behave exactly as if I'd run them without the #b). So, this means any attempt to use "url(#anythingCanGoHere)" for an image-taking attribute/property in an SVG document will end up referring to the SVG document itself. I'm not sure that's what we want.

> I'm not sure that's what we want. It's what the SVG spec calls for, no?

I'm not sure... I actually don't think there are any SVG properties that take url(uriOfAnImage.png), which is where this would come into play, so this mostly just matters in HTML inside of foreignObject. Also, RE the assertion -- both testcases on bug 596765 trigger it, too.

This is now WORKSFORME. The assertion was softened/changed in bug 596765 (in http://hg.mozilla.org/mozilla-central/rev/762e8424548c in particular), and that's almost certainly what fixed this. (See also bug 596765 comment 21, which is sort of similar to comment 2 here.)