This testcase triggers: ###!!! ASSERTION: DeletingFrameSubtree on a special frame. Prepare to crash.: '!IsFrameSpecial(aFrame)', file /Users/admin/trunk/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 9833 ###!!! ASSERTION: no common ancestor at all???: 'parent', file /Users/admin/trunk/mozilla/layout/base/nsLayoutUtils.cpp, line 344 This is likely to be a dup of bug 342120, but it involves an additional assertion, so I'm filing this bug to be sure.
This is fixed for me between a 2006-11-02 build and a 2006-11-04 build. I think this was fixed by the fix for bug 318592. It also seems fixed on branch. So, I'm marking this fixed, please reopen if this still can be seen.
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Depends on: 318592
Resolution: --- → FIXED
Verified (I no longer see the assertion with this testcase).
Status: RESOLVED → VERIFIED
Crashtest checked in. I guess a reftest would have been better (since there was content doubling), but I think the reftest for bug 318592 has that covered.
You need to log in before you can comment on or make changes to this bug.