See upcoming testcase, that crashes current trunk builds on load. It doesn't crash on branch builds. Talkback ID: TB21916184G nsFrameManager::RemoveFrame nsCSSFrameConstructor::ReconstructDocElementHierarchyInternal This regressed between 2005-10-16 and 2005-10-17. I backed out the patch for bug 311615 and after that I didn't see the crash anymore in my debug build.

So the problem is that we call NeedSpecialFrameReframe(), which calls FindNextSibling() without passing it a child. So FindNextSibling() returns the caption, we end up with a table outer frame for our parent, and then everything goes to hell... Should NeedSpecialFrameReframe pass in the child to FindNextSibling()? Doing that does fix this bug. But then again, given the existing bugs in IsValidSibling for replaced elements, would we still lose in general?

This was fixed somehow between 2006-10-23 and 2006-10-29 (I don't have builds in between right now): http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2006-10-23+05&maxdate=2006-10-29+05&cvsroot=%2Fcvsroot My guess would be this is fixed by the fix for bug 341858.