If an inline element has both a transform, and something that causes it to get a RenderLayer (like opacity), then we hit assertions via RenderLayer because we're trying to compute a borderBoxRect() on an inline while updating the transform.
Created attachment 27094 [details] Patch, changelog, testcases
Created attachment 27111 [details] Updated patch, removing isReplica()
Comment on attachment 27111 [details] Updated patch, removing isReplica() r=me
Committing to http://svn.webkit.org/repository/webkit/trunk ... M LayoutTests/ChangeLog A LayoutTests/fast/transforms/transform-on-inline.html A LayoutTests/fast/transforms/transform-table-row.html A LayoutTests/platform/mac/fast/transforms/transform-on-inline-expected.checksum A LayoutTests/platform/mac/fast/transforms/transform-on-inline-expected.png A LayoutTests/platform/mac/fast/transforms/transform-on-inline-expected.txt A LayoutTests/platform/mac/fast/transforms/transform-table-row-expected.checksum A LayoutTests/platform/mac/fast/transforms/transform-table-row-expected.png A LayoutTests/platform/mac/fast/transforms/transform-table-row-expected.txt M WebCore/ChangeLog M WebCore/rendering/RenderBox.cpp M WebCore/rendering/RenderReplica.cpp M WebCore/rendering/RenderTableRow.h Committed r40318