Created attachment 526483 [details] testcase ###!!! ASSERTION: Can't find frame in lines!: 'hasNext', file layout/base/nsBidiPresUtils.cpp, line 436 ###!!! ABORT: comparing iterators over different lists: 'mListLink == aOther.mListLink', file nsLineBox.h, line 722 May be related to bug 480686, which triggers only the abort.
AdvanceLineIteratorToFrame is the source of a lot of grief. Is there no simpler way to get from a frame to its containing line?
I mean, there's no direct reference from a frame to its line, so we have to search for it, and given the frame structures we have, that's not trivial as well as being a potential performance issue. Adding a reference from a frame to its line would be possible but maintaining it would also be error-prone.
http://hg.mozilla.org/mozilla-central/rev/a2450f7a0618 from bug 263359 includes the test as a crashtest.
Fixed by bug 263359