Created attachment 134630 [details] Repro case The attached svg code, when loaded in Chrome, crashes: SHOULD NEVER BE REACHED ../../third_party/WebKit/Source/WebCore/rendering/RenderInline.h(116) : virtual void WebCore::RenderInline::layout() DumpRenderTree gives the following stack: [6830:6830:105077618141:ERROR:process_util_posix.cc(142)] Received signal 11 base::debug::StackTrace::StackTrace() [0x6379fe] base::(anonymous namespace)::StackDumpSignalHandler() [0x2289114] 0x7f95eb9b4af0 WebCore::RenderInline::layout() [0xfc0402] WebCore::SVGRenderSupport::layoutChildren() [0xeb7087] WebCore::RenderSVGRoot::layout() [0xeb205c] WebCore::RenderObject::layoutIfNeeded() [0x1f26b66] WebCore::RenderBlock::insertFloatingObject() [0x1f0d181] WebCore::RenderBlock::LineBreaker::skipLeadingWhitespace() [0x1f54dd7] WebCore::RenderBlock::LineBreaker::nextLineBreak() [0x1f4f9b0] WebCore::RenderBlock::layoutRunsAndFloatsInRange() [0x1f4e1cb] WebCore::RenderBlock::layoutRunsAndFloats() [0x1f4d0df] WebCore::RenderBlock::layoutInlineChildren() [0x1f53689] WebCore::RenderBlock::layoutBlock() [0x1f07f48] WebCore::RenderBlock::layout() [0x1f074ac] WebCore::RenderView::layout() [0x208055b] WebCore::FrameView::layout() [0x9a8b8d] WebCore::Document::implicitClose() [0x104e729] WebCore::FrameLoader::checkCallImplicitClose() [0x8e498b] WebCore::FrameLoader::checkCompleted() [0x8e4783] WebCore::FrameLoader::finishedParsing() [0x8e3613] WebCore::Document::finishedParsing() [0x1059942] WebCore::XMLDocumentParser::end() [0x2341779] WebCore::XMLDocumentParser::finish() [0x23417ea] WebCore::DocumentWriter::endIfNotLoadingMainResource() [0x8df5b9] WebCore::DocumentWriter::end() [0x8dec10] WebCore::DocumentLoader::finishedLoading() [0x8cdd8b] WebCore::FrameLoader::finishedLoading() [0x8ec729] WebCore::MainResourceLoader::didFinishLoading() [0x8fe633] WebCore::ResourceLoader::didFinishLoading() [0x9121a6] WebCore::ResourceHandleInternal::didFinishLoading() [0x20ecc7e] webkit_glue::WebURLLoaderImpl::Context::OnCompletedRequest() [0x1eb5d67] (anonymous namespace)::RequestProxy::NotifyCompletedRequest() [0x25ceadb] base::internal::RunnableAdapter<>::Run() [0x25cef24] base::internal::InvokeHelper<>::MakeItSo() [0x25cee5b] base::internal::Invoker<>::Run() [0x25cedea] base::Callback<>::Run() [0x62fd5e] MessageLoop::RunTask() [0x225edda] MessageLoop::DeferOrRunPendingTask() [0x225f0ea] MessageLoop::DoWork() [0x225f2bb] base::MessagePumpGlib::RunWithDispatcher() [0x229c3ed] base::MessagePumpGlib::Run() [0x229c8f9] MessageLoop::RunInternal() [0x225e8c7] MessageLoop::RunHandler() [0x225e045] MessageLoop::Run() [0x225e01d] webkit_support::RunMessageLoop() [0x15b7011] TestShell::waitTestFinished() [0x472c55] TestShell::runFileTest() [0x469e21] runTest() [0x434d59] main [0x434884] 0x7f95eb99fc4d 0x41fe39
Looks like this is simply an instance of 63365. When the fix for that goes in, we should revisit this.
*** This bug has been marked as a duplicate of bug 63365 ***