Loading the testcase crashes Firefox. A nightly dereferences null in [@ nsNativeThemeMac::ThemeSupportsWidget] called by nsCSSFrameConstructor::AttributeChanged, while a debug build dereferences 0xddddddfd in nsCachedStyleData::GetStyleData called indirectly by [@ nsCSSFrameConstructor::AttributeChanged]. In a debug build, I see some assertions before the crash: ###!!! ASSERTION: We don't support out-of-flow kids: '!aListName', file /Users/admin/trunk/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1190 ###!!! ASSERTION: not in child list: 'nsFrameList(aChildFrame->GetParent()->GetFirstChild(listName)) .ContainsFrame(aChildFrame)', file /Users/admin/trunk/mozilla/layout/base/nsCSSFrameConstructor.cpp, line 1930 ###!!! ASSERTION: We don't support out-of-flow kids: '!aListName', file /Users/admin/trunk/mozilla/layout/xul/base/src/nsBoxFrame.cpp, line 1136

On the Firefox 2 branch, this testcase causes assertions but not a crash.

Jesse, do you still see this? I get neither asserts nor a crash with two different trunk builds (which both have some changes, but one has a clean layout/). Note that there were some fixes at the end of September (bug 330909 comes to mind) that might have fixed this testcase.

Works for me (non-Cocoa opt and non-Cocoa debug) and for enn (Cocoa debug).