Loading the testcase triggers: ###!!! ASSERTION: prev sibling not in line list: 'Not Reached', file /Users/jruderman/trunk/mozilla/layout/generic/nsBlockFrame.cpp, line 4805 ###!!! ASSERTION: unknown out of flow frame type: 'disp->mDisplay == NS_STYLE_DISPLAY_POPUP', file /Users/jruderman/trunk/mozilla/layout/generic/nsHTMLReflowState.cpp, line 522

I think this can lead to scary crashes. Is this bug related to bug 401042?

This looks like a bidi screwup to me... We call SplitInlineAncestors on the textframe inside the firstLetter. Then we try to split the float and stick it in the in-flow child list, which breaks. I suppose first-letter needs to be eBidiInlineContainer to handle cases when it's not floated, eh?

Comment on attachment 331231 [details] [diff] [review] This seems to do the trick I'm not really sure how first-letter is supposed to behave with bidi. I think Simon's looked into it a little bit?

Comment on attachment 331231 [details] [diff] [review] This seems to do the trick Umm. This regresses bug 384527 (which should show up as a test failure), but that may well be because my patch there depended on the previous buggy behaviour, like around https://bugzilla.mozilla.org/attachment.cgi?id=278544&action=diff#mozilla/layout/base/nsBidiPresUtils.cpp_sec4

Hmm. I'll make sure to run that test and see what happens. Thanks for the code pointer!

WFM on trunk. bz, do you care about the fate of your patch on this bug?

Not particularly, no.

That said, I'd like to know why it WFY. Did something get changed?

Could be a consequence of bug 332655 or one of its follow-ups

That said, I still see the assertions on trunk (OS X and Linux)

Should be fixed by bug 491547. Push testcase as crashtest http://hg.mozilla.org/mozilla-central/rev/4597c9ddc1ff

Variations still crash, see bug 534768. Thanks for adding the crashtest, tn ;)

Variations still crash, see bug 534768. Thanks for adding the crashtest, tn ;)