When layout out-of-flow positioned objects in regions with different writing modes, the following assert inside RenderBlock::clampToStartAndEndRegions triggers: ASSERT(region && inRenderFlowThread()) The reason for the ASSERT is that in these cases, the region is 0.
Created attachment 151282 [details] Patch
Comment on attachment 151282 [details] Patch r=me
Created attachment 153477 [details] Patch for landing
Comment on attachment 153477 [details] Patch for landing Clearing flags on attachment: 153477 Committed r123211: <http://trac.webkit.org/changeset/123211>
All reviewed patches have been landed. Closing bug.