###!!! ASSERTION: Computed overflow area must contain frame bounds: 'aNewSize.width == 0 || aNewSize.height == 0 || aOverflowArea->Contains(nsRect(nsPoint(0, 0), aNewSize))', file /Users/admin/trunk/mozilla/layout/generic/nsFrame.cpp, line 4936
I can reproduce with the testcase as a local file or data: URL, but not with the testcase as a Bugzilla attachment.
This usually happens when a frame reports that it has a negative width. A reflow log (http://www.mozilla.org/newlayout/doc/frame_reflow_debug.html) is usually also helpfull while the assert should correctly identify the "bad" frame.
WFM Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20060427 Minefield/3.0a1
Crashtest checked in.