Loading the testcase triggers: ###!!! ASSERTION: identical: 'pseudoType1 != pseudoType2', file /Users/admin/trunk/mozilla/layout/base/nsGenConList.cpp, line 133 ###!!! ASSERTION: sorting error: 'IsLast(aNode) || NodeAfter(Next(aNode), aNode)', file /Users/admin/trunk/mozilla/layout/base/nsGenConList.cpp, line 198

So this is basically an XBL bug; I wonder whether we have it filed... The issue is that we get into nsBindingManager::ContentRemoved and notify the frame constructor _before_ we modify the insertion point information, since we need to find the frames in the right place. But in this case, the <q> is an {ib} split, so we reframe the containing block, and in the process of doing that we end up recreating the <q> frames (even though it's not a child of the <dialog> anymore!) because the <q> is still in the insertion point array... Then we unwind and remove the <q> from the insertion point, but the bogus frames are still there. This looks pretty bad to me.

Not blocking since so far this is only an assertion. However it's mine for sure so I'll try to get to it before 1.9

WFM, Mac trunk. bz, is the underlying problem you mentioned in comment 2 still around? If so, can you please file a new bug?

This got fixed by fixing that underlying problem in bug 382376.

The same assertions can be triggered with a different testcase; see bug 367251.

Crashtest checked in.