Created attachment 329020 [details] testcase Loading the testcase triggers lots of warnings and assertions, including this assertion that I hadn't seen before: ###!!! ASSERTION: negative row frame height: 'rowFrame->GetSize().height >= 0', file /Users/jruderman/central/layout/tables/nsTableFrame.cpp, line 3394 Bernd added this assertion in bug 197391. Strangely, the testcase manages to get a large *width* even though only *heights* are specified in the testcase.
Still happens on trunk.
No longer happens on trunk.