+++ This bug was initially created as a clone of Bug #429969 +++ The crash in bug 429969 has been fixed, but attachment 316745 [details] still results in ###!!! ASSERTION: unexpected flow: 'mFrames.ContainsFrame(nextInFlow)', file /Users/jruderman/trunk/mozilla/layout/generic/nsInlineFrame.cpp, line 469 Is this still evidence of a security problem? In addition to bug 429969 this assertion also featured in sg:critical bug 402380

I don't see that assertion on trunk. Did you intend to file this against 1.9.1 and/or 1.9.0?

in bug 429969 comment 6 Clint said he saw it on both 1.9.1 and 1.9.2, at least on a Mac -- although that _was_ a month ago. Did something fix it meanwhile? ctalbert: would you mind retesting and see if this has gone away for you? It's possible there's some machine/config difference between you and smontagu, and also possible it's been fixed.

I haven't checked with this testcase, but the same assertion in bug 472950 comment 6 went away with the checkin for bug 332655. I'd like to get bug 332655 into 1.9.1 anyway, as soon as I'm sure there are no more regressions from it.

WFM, 0 assertions now on Mac. Bug 429969 is already public and in-testsuite+.