open the viewer and go into edit mode. select some text (all within the same text block, so not from plain text into bold, for example.) ctrl-b to make it bold. This creates a new b node, splits the text node into multiple text nodes, and moves the selected text out of its parent into the new b node. select somewhere else repeat a few times (not usually necessary, it often happens the first time) and you'll get the assertion below. stack: nsLineLayout::ForgetWordFrame(nsIFrame * 0x0126bd90) line 191 + 45 bytes TextFrame::Reflow(TextFrame * const 0x0126bd94, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 2167 nsInlineReflow::ReflowFrame(int 1, nsHTMLReflowMetrics & {...}, unsigned int & 0) line 450 nsInlineReflow::ReflowFrame(nsIFrame * 0x0126bd90, int 1, unsigned int & 0) line 274 + 20 bytes nsBlockFrame::ReflowInlineFrame(nsBlockReflowState & {...}, nsLineBox * 0x01260a50, nsIFrame * 0x0126bd90, int * 0x0012c948) line 2525 + 31 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01260a50, int * 0x0012c9ac) line 1717 + 24 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1472 + 20 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x01260974, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 1) line 921 + 18 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x01260970, const nsRect & {x=0 y=0 width=8880 height=1073741824}, int 1, nsMargin & {top=0 right=0 bottom=0 left=0}, unsigned int & 1) line 192 + 39 bytes nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x01263250, int * 0x0012d7e8) line 2335 + 45 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01263250, int * 0x0012d7e8) line 1683 + 20 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1472 + 20 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x01234514, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 921 + 18 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x01234510, const nsRect & {x=0 y=0 width=9120 height=1073741824}, int 1, nsMargin & {top=0 right=0 bottom=0 left=0}, unsigned int & 0) line 192 + 39 bytes nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x01234d50, int * 0x0012e624) line 2335 + 45 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01234d50, int * 0x0012e624) line 1683 + 20 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1472 + 20 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x01233124, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 921 + 18 bytes nsAreaFrame::Reflow(nsAreaFrame * const 0x01233124, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 503 + 25 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x01233120, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 364 + 28 bytes RootFrame::Reflow(RootFrame * const 0x012335e4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 256 nsContainerFrame::ReflowChild(nsIFrame * 0x012335e0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 364 + 28 bytes nsScrollFrame::Reflow(nsScrollFrame * const 0x01232a84, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 350 nsContainerFrame::ReflowChild(nsIFrame * 0x01232a80, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 364 + 28 bytes ViewportFrame::Reflow(ViewportFrame * const 0x0125d744, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 438 PresShell::ResizeReflow(PresShell * const 0x0125b120, int 9120, int 4470) line 908 PresShell::ResizeReflow(PresShell * const 0x0125b124, nsIView * 0x01259c60, int 9120, int 4470) line 1892 nsViewManager::SetWindowDimensions(nsViewManager * const 0x01259ef0, int 9120, int 4470) line 293

I just checked in a fix for this.

Fixed in April 5th Build.