Reliably crashes the version of Safari that ships with Tiger in addition to the most recent nightly build. I'm running OSX 10.4.8.
Created attachment 13369 [details] Reduction (will crash when the instructions are followed) Click "Ready" (notice the incorrect layout), then click "Crash".
Created attachment 13370 [details] Slightly more general reduction (ditto) The "foo" div doesn't get marked for layout. The check in layoutBlockChildren() is // If an element might be affected by the presence of floats, then always mark it for // layout. which doesn't cover an object being affected by floats no longer intruding into it.
Created attachment 13371 [details] Possible fix This patch fixes the problem, but I'm afraid it adds too many unnecessary layouts. I am going to explore an alternative approach based on detecting the changes to overhang.
Created attachment 13372 [details] Detect withdrawn floats
Comment on attachment 13372 [details] Detect withdrawn floats r=me
Landed in r19852.