--- a/layout/generic/nsTextFrameThebes.cpp
+++ b/layout/generic/nsTextFrameThebes.cpp
@@ -741,57 +741,30 @@ TextContainsLineBreakerWhiteSpace(const 
     for (i = 0; i < aLength; ++i) {
       if (nsLineBreaker::IsSpace(chars[i]))
         return PR_TRUE;
     }
     return PR_FALSE;
   }
 }
 
-struct TextRunFrameTraversal {
-  nsIFrame*    mFrameToDescendInto;
-  PRPackedBool mDescendIntoFrameSiblings;
-  PRPackedBool mTextRunCanCrossFrameBoundary;
-};
-
-static TextRunFrameTraversal
-CanTextRunCrossFrameBoundary(nsIFrame* aFrame, nsIAtom* aType)
-{
-  NS_ASSERTION(aType == aFrame->GetType(), "Wrong type");
-
-  TextRunFrameTraversal result;
-
-  PRBool continuesTextRun = aFrame->CanContinueTextRun();
-  if (aType == nsGkAtoms::placeholderFrame) {
-    // placeholders are "invisible", so a text run should be able to span
-    // across one. But don't descend into the out-of-flow.
-    // ... Except for first-letter floats, which are really in-flow
-    // from the point of view of capitalization etc, so we'd better
-    // descend into them. But we actually need to break the textrun for
-    // first-letter floats since things look bad if, say, we try to make a
-    // ligature across the float boundary.
-    result.mFrameToDescendInto = continuesTextRun
-      ? (static_cast<nsPlaceholderFrame*>(aFrame))->GetOutOfFlowFrame()
-      : nsnull;
-    result.mDescendIntoFrameSiblings = PR_FALSE;
-    result.mTextRunCanCrossFrameBoundary = !result.mFrameToDescendInto;
-  } else {
-    result.mFrameToDescendInto = continuesTextRun
-      ? aFrame->GetFirstChild(nsnull) : nsnull;
-    result.mDescendIntoFrameSiblings = PR_TRUE;
-    result.mTextRunCanCrossFrameBoundary = continuesTextRun;
-  }    
-  return result;
+static PRBool
+CanTextRunCrossFrameBoundary(nsIFrame* aFrame)
+{
+  // placeholders are "invisible", so a text run should be able to span
+  // across one. The text in the out-of-flow, if any, will not be included
+  // in this textrun of course.
+  return aFrame->CanContinueTextRun() ||
+    aFrame->GetType() == nsGkAtoms::placeholderFrame;
 }
 
 BuildTextRunsScanner::FindBoundaryResult
 BuildTextRunsScanner::FindBoundaries(nsIFrame* aFrame, FindBoundaryState* aState)
 {
-  nsIAtom* frameType = aFrame->GetType();
-  nsTextFrame* textFrame = frameType == nsGkAtoms::textFrame
+  nsTextFrame* textFrame = aFrame->GetType() == nsGkAtoms::textFrame
     ? static_cast<nsTextFrame*>(aFrame) : nsnull;
   if (textFrame) {
     if (aState->mLastTextFrame &&
         textFrame != aState->mLastTextFrame->GetNextInFlow() &&
         !ContinueTextRunAcrossFrames(aState->mLastTextFrame, textFrame)) {
       aState->mSeenTextRunBoundaryOnThisLine = PR_TRUE;
       if (aState->mSeenSpaceForLineBreakingOnThisLine)
         return FB_FOUND_VALID_TEXTRUN_BOUNDARY;
@@ -817,34 +790,38 @@ BuildTextRunsScanner::FindBoundaries(nsI
         aState->mSeenSpaceForLineBreakingOnThisLine = PR_TRUE;
         if (aState->mSeenTextRunBoundaryOnLaterLine)
           return FB_FOUND_VALID_TEXTRUN_BOUNDARY;
       }
     }
     return FB_CONTINUE; 
   }
 
-  TextRunFrameTraversal traversal =
-    CanTextRunCrossFrameBoundary(aFrame, frameType);
-  if (!traversal.mTextRunCanCrossFrameBoundary) {
+  PRBool continueTextRun = CanTextRunCrossFrameBoundary(aFrame);
+  PRBool descendInto = PR_TRUE;
+  if (!continueTextRun) {
+    // XXX do we need this? are there frames we need to descend into that aren't
+    // float-containing-blocks?
+    descendInto = !aFrame->IsFloatContainingBlock();
     aState->mSeenTextRunBoundaryOnThisLine = PR_TRUE;
     if (aState->mSeenSpaceForLineBreakingOnThisLine)
       return FB_FOUND_VALID_TEXTRUN_BOUNDARY;
   }
   
-  for (nsIFrame* f = traversal.mFrameToDescendInto; f;
-       f = f->GetNextSibling()) {
-    FindBoundaryResult result = FindBoundaries(f, aState);
-    if (result != FB_CONTINUE)
-      return result;
-    if (!traversal.mDescendIntoFrameSiblings)
-      break;
-  }
-
-  if (!traversal.mTextRunCanCrossFrameBoundary) {
+  if (descendInto) {
+    nsIFrame* child = aFrame->GetFirstChild(nsnull);
+    while (child) {
+      FindBoundaryResult result = FindBoundaries(child, aState);
+      if (result != FB_CONTINUE)
+        return result;
+      child = child->GetNextSibling();
+    }
+  }
+
+  if (!continueTextRun) {
     aState->mSeenTextRunBoundaryOnThisLine = PR_TRUE;
     if (aState->mSeenSpaceForLineBreakingOnThisLine)
       return FB_FOUND_VALID_TEXTRUN_BOUNDARY;
   }
 
   return FB_CONTINUE;
 }
 
@@ -1225,36 +1202,39 @@ void BuildTextRunsScanner::ScanFrame(nsI
     AccumulateRunInfo(frame);
     if (mMappedFlows.Length() == 1) {
       mCurrentFramesAllSameTextRun = frame->GetTextRun();
       mCurrentRunTrimLeadingWhitespace = mTrimNextRunLeadingWhitespace;
     }
     return;
   }
 
-  TextRunFrameTraversal traversal =
-    CanTextRunCrossFrameBoundary(aFrame, frameType);
+  PRBool continueTextRun = CanTextRunCrossFrameBoundary(aFrame);
+  PRBool descendInto = PR_TRUE;
   PRBool isBR = frameType == nsGkAtoms::brFrame;
-  if (!traversal.mTextRunCanCrossFrameBoundary) {
+  if (!continueTextRun) {
     // BR frames are special. We do not need or want to record a break opportunity
     // before a BR frame.
     FlushFrames(PR_TRUE, isBR);
     mCommonAncestorWithLastFrame = aFrame;
     mTrimNextRunLeadingWhitespace = PR_FALSE;
+    // XXX do we need this? are there frames we need to descend into that aren't
+    // float-containing-blocks?
+    descendInto = !aFrame->IsFloatContainingBlock();
     mStartOfLine = PR_FALSE;
   }
 
-  for (nsIFrame* f = traversal.mFrameToDescendInto; f;
-       f = f->GetNextSibling()) {
-    ScanFrame(f);
-    if (!traversal.mDescendIntoFrameSiblings)
-      break;
-  }
-
-  if (!traversal.mTextRunCanCrossFrameBoundary) {
+  if (descendInto) {
+    nsIFrame* f;
+    for (f = aFrame->GetFirstChild(nsnull); f; f = f->GetNextSibling()) {
+      ScanFrame(f);
+    }
+  }
+
+  if (!continueTextRun) {
     // Really if we're a BR frame this is unnecessary since descendInto will be
     // false. In fact this whole "if" statement should move into the descendInto.
     FlushFrames(PR_TRUE, isBR);
     mCommonAncestorWithLastFrame = aFrame;
     mTrimNextRunLeadingWhitespace = PR_FALSE;
   }
 
   LiftCommonAncestorWithLastFrameToParent(aFrame->GetParent());
@@ -3207,17 +3187,17 @@ nsContinuingTextFrame::Init(nsIContent* 
   nsTextFrame* nextContinuation =
     static_cast<nsTextFrame*>(aPrevInFlow->GetNextContinuation());
 #endif // IBMBIDI
   // Hook the frame into the flow
   SetPrevInFlow(aPrevInFlow);
   aPrevInFlow->SetNextInFlow(this);
   nsTextFrame* prev = static_cast<nsTextFrame*>(aPrevInFlow);
   mContentOffset = prev->GetContentOffset() + prev->GetContentLengthHint();
-  NS_ASSERTION(mContentOffset < PRInt32(aContent->GetText()->GetLength()),
+  NS_ASSERTION(mContentOffset < aContent->GetText()->GetLength(),
                "Creating ContinuingTextFrame, but there is no more content");
   if (prev->GetStyleContext() != GetStyleContext()) {
     // We're taking part of prev's text, and its style may be different
     // so clear its textrun which may no longer be valid (and don't set ours)
     prev->ClearTextRun();
   } else {
     mTextRun = prev->GetTextRun();
   }

--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -843,17 +843,16 @@ fails-if(MOZ_WIDGET_TOOLKIT=="gtk2") == 
 == 428521-1a.html 428521-1-ref.html
 == 428521-1b.html 428521-1-ref.html
 == 428521-1c.html 428521-1-ref.html
 random == 429849-1.html 429849-1-ref.html # bug 432288
 == 430412-1.html 430412-1-ref.html
 == 430813-1.html 430813-1-ref.html
 == 430813-2.html 430813-2-ref.html
 == 430813-3.html 430813-3-ref.html
-== 431341-1.html 431341-1-ref.html
 == 440112.html 440112-ref.html
 == 433640-1.html 433640-1-ref.html
 == 433700.html 433700-ref.html
 == 436356-1.html 436356-1-ref.html
 == 436356-2.html 436356-2-ref.html
 == 438981-1.xhtml about:blank
 == 439004-1.html 439004-1-ref.html
 == 439910.html 439910-ref.html