All
nsCSSFrameConstructor::ConstructInline leaks the inline frame if one of its children fails to construct, triggering abort w/ "Assertion failure: mPresArenaAllocCount == 0 (Some pres arena objects were not freed), at nsPresShell.cpp:864"
Layout