Loading the testcase triggers: ###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file /Users/jruderman/trunk/mozilla/layout/base/../generic/nsPlaceholderFrame.h, line 175

#7 0xb674ed28 in PresShell::GetPrimaryFrameFor (this=0x8c17f88, aContent=0x8c36300) at ../../../mozilla/layout/base/nsPresShell.cpp:4745 #8 0xb69353a9 in nsBoxObject::GetFrame (this=0x8c31ea4, aFlushLayout=0) at ../../../../../mozilla/layout/xul/base/src/nsBoxObject.cpp:141 #9 0xb6d219a4 in nsTreeBoxObject::GetTreeBody (this=0x8c31ea0) at ../../../../../../../mozilla/layout/xul/base/src/tree/src/nsTreeBoxObject.cpp:116 #10 0xb6d22078 in nsTreeBoxObject::GetColumns (this=0x8c31ea0, aColumns=0xbfffd910) at ../../../../../../../mozilla/layout/xul/base/src/tree/src/nsTreeBoxObject.cpp:234 #11 0xb6d237d5 in nsTreeColFrame::InvalidateColumns (this=0x8c3094c) at ../../../../../../../mozilla/layout/xul/base/src/tree/src/nsTreeColFrame.cpp:228 #12 0xb6d231cc in nsTreeColFrame::Destroy (this=0x8c3094c) at ../../../../../../../mozilla/layout/xul/base/src/tree/src/nsTreeColFrame.cpp:102 Then we start walking a partially-destroyed frame tree, and it's all bad from there. I'm sure we already have bugs on this....

See https://bugzilla.mozilla.org/show_bug.cgi?id=391178#c5 and following... not sure which way the dependency should go, but marking a relationship.

Reassigning to dholbert since 391178 is his and is where we'll be fixing this, I think.

Fixed by checkin of bug 391178.

Crashtest checked in.