Created attachment 526470 [details]
###!!! ASSERTION: Creating ContinuingTextFrame, but there is no more content: 'mContentOffset < PRInt32(aContent->GetText()->GetLength())', file layout/generic/nsTextFrameThebes.cpp, line 3743
Strangely, the testcase has to be XHTML. Standards-mode HTML doesn't trigger the bug.
Created attachment 526471 [details]
This is caused by http://hg.mozilla.org/mozilla-central/rev/2ad43389d244
Created attachment 526570 [details] [diff] [review]
I folded the fix and testcase into http://hg.mozilla.org/mozilla-central/rev/3d475b322365 when rechecking in bug 263359