Created attachment 526470 [details] testcase ###!!! ASSERTION: Creating ContinuingTextFrame, but there is no more content: 'mContentOffset < PRInt32(aContent->GetText()->GetLength())', file layout/generic/nsTextFrameThebes.cpp, line 3743 Strangely, the testcase has to be XHTML. Standards-mode HTML doesn't trigger the bug.
This is caused by http://hg.mozilla.org/mozilla-central/rev/2ad43389d244
I folded the fix and testcase into http://hg.mozilla.org/mozilla-central/rev/3d475b322365 when rechecking in bug 263359