Attempting to load the indicated url causes a repeatable crash. Works on windows. #0 0x40342c1b in nsBlockBandData::ComputeAvailSpaceRect (this=0xbfffc370) at ../../../../../mozilla/layout/html/base/src/nsBlockBandData.cpp:186 #1 0x40342955 in nsBlockBandData::GetAvailableSpace (this=0xbfffc370, aY=0, aResult=@0xbfffc528) at ../../../../../mozilla/layout/html/base/src/nsBlockBandData.cpp:69 #2 0x4031a90d in nsBlockReflowState::GetAvailableSpace (this=0xbfffc244) at ../../../../../mozilla/layout/html/base/src/nsBlockFrame.cpp:386 #3 0x4031c246 in nsBaseIBFrame::ReflowLine (this=0x8239808, aState=@0xbfffc244, aLine=0x8239dc8, aKeepGoing=@0xbfffbbe4) at ../../../../../mozilla/layout/html/base/src/nsBlockFrame.cpp:1603 #4 0x4031bc4b in nsBaseIBFrame::ReflowDirtyLines (this=0x8239808, aState=@0xbfffc244) at ../../../../../mozilla/layout/html/base/src/nsBlockFrame.cpp:1328 #5 0x40320e6a in nsBlockFrame::ReflowDirtyLines (this=0x8239808, aState=@0xbfffc244) at ../../../../../mozilla/layout/html/base/src/nsBlockFrame.cpp:4867 #6 0x4031b27c in nsBaseIBFrame::Reflow (this=0x8239808, aPresContext=@0x821c938, aMetrics=@0xbfffc73c, aReflowState=@0xbfffc610, aStatus=@0xbfffc6e0) at ../../../../../mozilla/layout/html/base/src/nsBlockFrame.cpp:803

fixed.

verified in 1/26 build.

Inserting Milestone info.