###!!! ASSERTION: aFrame is already associated with a region: '!GetFrameInfoFor(aFrame)', file /Users/jruderman/trunk/mozilla/layout/generic/nsSpaceManager.cpp, line 866

It looks like we reflow the float on the first line, then push the float placeholder on the overflow list of the inline in question (together with the text "bbb", etc). So we end up reflowing the float _again_ on the second line, and that's when we assert... Note also the warning about the float cache not matching the actual float list that ensues.

Is the rendering correct? It seems strange to me that the seemingly adjacent "aaa" and "bbb" are split, but I'm not really familiar with the rules for floats.

I don't think we should be splitting the text there, no.

New textframe doesn't split there. That also means it suppresses this bug, although the underlying issue is probably still around.

WFM with this testcase on trunk (since new textframe has landed). It would be nice if someone would create a new testcase that still demonstrates the bug.

I see the assertion on Mac trunk with this testcase. Does it demonstrate the same bug or a different bug?

WFM with both testcases now. roc, is the underlying issue you mentioned in comment 4 still around?

I don't know, but if testcase2 is WFY, then I have no reason to believe it is.

Ok.

I checked in both testcases as crashtests.