Created attachment 462044 [details] html ASSERTION FAILED: !mode.contains(IsFixed) /home/fuzzer/temp/webkit/webkitgtk-2.36.0/Source/WebCore/rendering/svg/LegacyRenderSVGRoot.cpp(403) : virtual void WebCore::LegacyRenderSVGRoot::mapLocalToContainer(const WebCore::RenderLayerModelObject *, WebCore::TransformState &, OptionSet<WebCore::MapCoordinatesMode>, bool *) const ** (MiniBrowser:135369): WARNING **: 18:33:58.239: WebProcess CRASHED
<rdar://problem/99645492>
Created attachment 463636 [details] Patch
Created attachment 463637 [details] Patch
r=me. <svg> can be positioned, the rest of the SVG tree not.
Created attachment 463638 [details] Patch
Committed 256907@main (917f78d471e1): <https://commits.webkit.org/256907@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 463638 [details].
Comment on attachment 463638 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=463638&action=review > COMMIT_MESSAGE:7 > +but postion: fixed is allowed on outermost svg elements, so postion