Created attachment 278374 [details] testcase (crashes Firefox when loaded) Loading the testcase makes Firefox crash with a null dereference [@ nsTextFrame::EnsureTextRun]. The testcase looks pretty simple and harmless. Aside from dir="rtl", the testcase is just sticking a simple inline element in a block and removing it. I think there's some unnecessary wrapping, too. Before the crash, 'G' appears on a separate line from 'h' unnecessarily.
This doesn't crash for me in today's build. Could it have been fixed by bug 382429?
No longer crashes for me.
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → WORKSFORME
Crashtest checked in.
Mass-assigning the new rtl keyword to RTL-related (see bug 349193).
Crash Signature: [@ nsTextFrame::EnsureTextRun]
You need to log in before you can comment on or make changes to this bug.