diff --git a/layout/base/crashtests/560447-1.html b/layout/base/crashtests/560447-1.html
new file mode 100644
index 00000000000..e6d4f9cb4ed
--- /dev/null
+++ b/layout/base/crashtests/560447-1.html
@@ -0,0 +1 @@
+%84%24DD%89%20%0F%3A%20%B0%60%5B%1D%03%8E%8Ex%0C%C9%12%24%B2%2C)%8B%1C%FA%D8%B2%E6%1Cg0eF2%F0%D1AE%FF%9B%08%094J%82HN%C4K%BE%80%86%C45t%88%B19%A6%7C%05S%CA%92)%CA!%EB%E48%40%C1U%DCO%AA%8B%12*%88%19%E2X%BDn%F3%C0%F2cp%D1%A1%90%B2%006%85%25%90%14%A3Z%06%A7%F0%26-%F0%40%08%079%07%EA%CEa%9B%F4%80Z%01%01%128%10%80%82Y5H%80E%1A%06%10%400P%C6%B7%CA%09%84%0C%60r%3F9l%D5%02%80%970%15%24%3F%9EA%5E%04%BB%CF%F0U%B8%A9EK%C4%3C%C70_%12Y%DD%C9%3E%08%2C%ED%E4%06Q%1A%00%60%40s%F7%9F%D0%7Flo~%3A%A0%B2qs4%05(%C7S%02Q%01%06%07%02%60%FA%FA%BC%1D%1D%B7%B8%AF%F8%D1%FD%FC%97%BB%CDB%F6H%22_%1E%B4w%3A%C4%88%16%60%DF%3E%163%D3E%CA%D2%07%E0%93Q%81%FF%00%D6%A4%5B%7C2)%B0_9%06%40%A0%E0%82Y(%F2%07Es%08%40%17*%0D%0Cd%C4%03%84E%B3%8D%01%1B%400%FF%C1%87%1FZ%20%01%0A%13%CA%01L%89xi%F1%80%85F%84%60%E0j%B5%09%A0%803%20%D6%88%C2T%A0%05%93%89%03%08p%C0%06%3E%08%8C%C4%CD%2B%09h%40%81%075%82%88%82%04%09%90h_%16*%B2%F8%84%8B%EDd'K%05%1ALPA%92%1F%A20%81%06%0Dl%B0%81%09j%A8!e%1Ea%5C!%E6%06%1D0p%C1%96%5Czy%E6%23Txq%82%08or9%81%97t%F6y%84%96z%F2%E9%E7%A0B%00%1A%A7%05%84%12jh%92(d%90%E8%A0%8B%DA%98%C1%9C%8F6%11%A9%92%93V%FA%C8%08G%06j%01%A5%9A%16%A1%01%5E%81N%00B%A8_P%E0%00%05%A5%9E%8Aj%13%20%60%E0%00%88%16%D4X%C1%05%1A%BCz%C4%08%20%A8z%C1%87%17%D4z%EB%04oZ%E0%EA%A0'%0Ct%82%09%CC6%CB%EC%05%0E%60%F0!%04%1D%7C%D8A%02%AC%B2u%81%AB%234%7B%C2%17%A1TPA0%E4%92%EBA%04%B3N%20%91k%BA%1D%60%80%E4%04%1E%5C%2B%EE%B8%C1T%E0%C1%BD%F8z%80A%1E%BC%C2%1B%01%B1%15D%F0.%BC%D0%FEJA%05%18%80%60%CD%A3%C4u%D0%81%BE%F6b%F0%26%AB%EA%3A%00-%AB%05%7F8%02%A8%AB%88%90%80%87%D0zpA%06%19X%80A%02%BFB%20%F2%C9%F7%BA%E9%E1%87%99%FA%99%A5%06%25%5B%AC%01%1B%BC%BEy%AB%AC%C0%5E%20%2B%0A%F3N%60A%AE%BA%0A1%82%05%17%24%20%B1%D0!f%A0%C1%9A%1Ahpl%D1%24%80%F0A%07NS%ED%A7%09%95%06%01%00%3B)
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index e7036eb3bb5..41927df1470 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -287,3 +287,4 @@ load 538207-1.xhtml
load 538210-1.html
load 541869-1.xhtml
load 541869-2.html
+load 560447-1.html
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index e62cd6ea40f..6ca5ff40936 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -6218,7 +6218,11 @@ nsCSSFrameConstructor::MaybeConstructLazily(Operation aOperation,
while (content &&
!content->HasFlag(NODE_DESCENDANTS_NEED_FRAMES)) {
NS_ASSERTION(content->GetPrimaryFrame() &&
- !content->HasFlag(NODE_NEEDS_FRAME),
+ (!content->HasFlag(NODE_NEEDS_FRAME) ||
+ content->GetPrimaryFrame()->GetContent() != content),
+ //XXX the content->GetPrimaryFrame()->GetContent() != content
+ // check is needed due to bug 135040. Remove it once that's
+ // fixed.
"Ancestors of nodes with frames to be constructed lazily "
"should have frames and not have NEEDS_FRAME bit set");
content->SetFlags(NODE_DESCENDANTS_NEED_FRAMES);
@@ -6227,14 +6231,22 @@ nsCSSFrameConstructor::MaybeConstructLazily(Operation aOperation,
// Set NODE_NEEDS_FRAME on the new nodes.
if (aOperation == CONTENTINSERT) {
- NS_ASSERTION(!aChild->GetPrimaryFrame(),
+ NS_ASSERTION(!aChild->GetPrimaryFrame() ||
+ aChild->GetPrimaryFrame()->GetContent() != aChild,
+ //XXX the aChild->GetPrimaryFrame()->GetContent() != aChild
+ // check is needed due to bug 135040. Remove it once that's
+ // fixed.
"setting NEEDS_FRAME on a node that already has a frame?");
aChild->SetFlags(NODE_NEEDS_FRAME);
} else { // CONTENTAPPEND
PRUint32 containerCount = aContainer->GetChildCount();
for (PRUint32 i = aIndex; i < containerCount; i++) {
nsIContent* child = aContainer->GetChildAt(i);
- NS_ASSERTION(!child->GetPrimaryFrame(),
+ NS_ASSERTION(!child->GetPrimaryFrame() ||
+ child->GetPrimaryFrame()->GetContent() != child,
+ //XXX the child->GetPrimaryFrame()->GetContent() != child
+ // check is needed due to bug 135040. Remove it once that's
+ // fixed.
"setting NEEDS_FRAME on a node that already has a frame?");
child->SetFlags(NODE_NEEDS_FRAME);
}
@@ -6292,7 +6304,11 @@ nsCSSFrameConstructor::CreateNeededFrames(nsIContent* aContent)
for (PRUint32 i = 0; i < childCount; i++) {
nsIContent* child = aContent->GetChildAt(i);
if (child->HasFlag(NODE_NEEDS_FRAME)) {
- NS_ASSERTION(!child->GetPrimaryFrame(),
+ NS_ASSERTION(!child->GetPrimaryFrame() ||
+ child->GetPrimaryFrame()->GetContent() != child,
+ //XXX the child->GetPrimaryFrame()->GetContent() != child
+ // check is needed due to bug 135040. Remove it once that's
+ // fixed.
"NEEDS_FRAME set on a node that already has a frame?");
if (!inRun) {
inRun = PR_TRUE;