Created attachment 568194 [details] testcase (asserts fatally when loaded) ###!!! ASSERTION: Can't find frame in lines!: 'hasNext', file layout/base/nsBidiPresUtils.cpp, line 377 ###!!! ABORT: comparing iterators over different lists: 'mListLink == aOther.mListLink', file layout/generic/nsLineBox.h, line 722 This testcase uses a layout feature added recently, in bug 613149.
Created attachment 570955 [details] [diff] [review] Patch The real patch this time
Can you explain what the bug is and why this fixes it?
Created attachment 571496 [details] [diff] [review] Patch v.2 Putting a description of the bug into words made me realize that there is a simpler fix for it :) What was happening was that when a bidi continuation in an element with unicode-bidi: -moz-isolate crossed a column break, we were passing the saved mPrevFrame from the previous column in the subparagraph into AdvanceLineIteratorToFrame, even though we had meanwhile created a new nsBlockInFlowLineIterator for the new column. The new patch zeros out the mPrevFrame in the subparagraph as well as the containing paragraph when creating the new line iterator.
Comment on attachment 571496 [details] [diff] [review] Patch v.2 https://hg.mozilla.org/integration/mozilla-inbound/rev/3025c93444a6