###!!! ASSERTION: Couldn't find placeholder!: 'firstFrame', file /Users/jruderman/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 817

This is exactly what bz mentioned here: http://lxr.mozilla.org/seamonkey/source/layout/generic/nsHTMLReflowState.cpp#804 // XXXbz the line box is not fully reflown yet if our containing block is // relatively positioned... In this case, the placeholder is actually on the span's overflow-list. I could hack this code to also search overflow lists and blockFrame's next-in-flows, but that would be a bit nasty. It would make more sense to defer layout of the span's abs-pos children until we've reflowed all frames for the span --- if we can get away with that. I'd like to do similar for blocks too, but I'm not 100% sure we can, in general.

WFM, Mac trunk. Roc, does anything you mentioned in comment 1 need to become a separate bug?

Crashtest checked in.