ASSERTION FAILED: oldText (/WebKit/WebCore/rendering/RenderBlock.cpp:4123 virtual void WebCore::RenderBlock::updateFirstLetter()) To reproduce the bug, open the test case with a debug build and click the Test button.
Created attachment 15108 [details] Test case
Changing to P1 since release builds eventually crash when destroying the page.
The actual bug is that RenderContainer::updateBeforeAfterContentForContainer() doesn't know how to update the old content's style if it also has a first-letter pseudo-element style. The update loops assumes that the children of the before/after generated content container are either text renderers or images, and that they all have the BEFORE or AFTER style type.
Created attachment 15431 [details] Avoid updating the style of first-letter containers when updating 'before' content Includes change log and layout test. This patch does not address the fact that 'before' content is always nested so with non-layout style changes you still get bug 14550, but no crash.
Comment on attachment 15431 [details] Avoid updating the style of first-letter containers when updating 'before' content r=me
Landed in r24094.