diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 35c783aa814..ad8fb08d6bd 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -7489,6 +7489,13 @@ nsCSSFrameConstructor::ConstructSVGFrame(nsFrameConstructorState& aState,
 }
 #endif // MOZ_SVG
 
+// If page-break-before is set, this function constructs a page break frame,
+// EXCEPT for on these types of elements:
+//  * row groups, rows, cells (these are handled internally by tables)
+//  * fixed- and absolutely-positioned elements (currently, our positioning
+//    code doesn't expect positioned frames to have nsPageBreakFrame siblings)
+//
+// Returns true iff we should construct a page break frame after this element.
 PRBool
 nsCSSFrameConstructor::PageBreakBefore(nsFrameConstructorState& aState,
                                        nsIContent*              aContent,
@@ -7498,9 +7505,9 @@ nsCSSFrameConstructor::PageBreakBefore(nsFrameConstructorState& aState,
 {
   const nsStyleDisplay* display = aStyleContext->GetStyleDisplay();
 
-  // See if page-break-before is set for all elements except row groups, rows, cells 
-  // (these are handled internally by tables) and construct a page break frame if so.
   if (NS_STYLE_DISPLAY_NONE != display->mDisplay &&
+      NS_STYLE_POSITION_FIXED    != display->mPosition &&
+      NS_STYLE_POSITION_ABSOLUTE != display->mPosition &&
       (NS_STYLE_DISPLAY_TABLE == display->mDisplay ||
        !IsTableRelated(display->mDisplay, PR_TRUE))) { 
     if (display->mBreakBefore) {
diff --git a/layout/generic/nsBlockFrame.cpp b/layout/generic/nsBlockFrame.cpp
index 9c3e5f10014..ff5096a310d 100644
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -5160,10 +5160,16 @@ nsBlockInFlowLineIterator::nsBlockInFlowLineIterator(nsBlockFrame* aFrame,
   } while (Next());
 }
 
+nsBlockFrame::line_iterator
+nsBlockInFlowLineIterator::End()
+{
+  return mInOverflowLines ? mInOverflowLines->end() : mFrame->end_lines();
+}
+
 PRBool
 nsBlockInFlowLineIterator::IsLastLineInList()
 {
-  line_iterator end = mInOverflowLines ? mInOverflowLines->end() : mFrame->end_lines();
+  line_iterator end = End();
   return mLine != end && mLine.next() == end;
 }
 
diff --git a/layout/generic/nsBlockFrame.h b/layout/generic/nsBlockFrame.h
index bc19de29754..2a21a638937 100644
--- a/layout/generic/nsBlockFrame.h
+++ b/layout/generic/nsBlockFrame.h
@@ -706,6 +706,13 @@ public:
   PRBool IsLastLineInList();
   nsBlockFrame* GetContainer() { return mFrame; }
   PRBool GetInOverflow() { return mInOverflowLines != nsnull; }
+
+
+  /**
+   * Returns the end-iterator of whatever line list we're in.
+   */
+  line_iterator End();
+
   /**
    * Returns false if there are no more lines. After this has returned false,
    * don't call any methods on this object again.
diff --git a/layout/generic/nsHTMLReflowState.cpp b/layout/generic/nsHTMLReflowState.cpp
index 11c541e799f..b6625eda1c6 100644
--- a/layout/generic/nsHTMLReflowState.cpp
+++ b/layout/generic/nsHTMLReflowState.cpp
@@ -950,7 +950,7 @@ nsHTMLReflowState::CalculateHypotheticalBox(nsPresContext*    aPresContext,
       // this line.      
       // XXXbz the line box is not fully reflown yet if our containing block is
       // relatively positioned...
-      if (lineBox != blockFrame->end_lines()) {
+      if (lineBox != iter.End()) {
         nsIFrame * firstFrame = lineBox->mFirstChild;
         PRBool found = PR_FALSE;
         PRBool allEmpty = PR_TRUE;
diff --git a/layout/generic/nsPageFrame.cpp b/layout/generic/nsPageFrame.cpp
index 3cbd7e1057e..1f26c339267 100644
--- a/layout/generic/nsPageFrame.cpp
+++ b/layout/generic/nsPageFrame.cpp
@@ -601,6 +601,12 @@ nsPageBreakFrame::GetIntrinsicWidth()
   return nsPresContext::CSSPixelsToAppUnits(1);
 }
 
+nscoord
+nsPageBreakFrame::GetIntrinsicHeight()
+{
+  return 0;
+}
+
 nsresult 
 nsPageBreakFrame::Reflow(nsPresContext*          aPresContext,
                          nsHTMLReflowMetrics&     aDesiredSize,
diff --git a/layout/generic/nsPageFrame.h b/layout/generic/nsPageFrame.h
index b82f05b9df8..bb3fdb3e9e2 100644
--- a/layout/generic/nsPageFrame.h
+++ b/layout/generic/nsPageFrame.h
@@ -143,6 +143,7 @@ class nsPageBreakFrame : public nsLeafFrame {
 protected:
 
   virtual nscoord GetIntrinsicWidth();
+  virtual nscoord GetIntrinsicHeight();
 
     PRBool mHaveReflowed;
 
diff --git a/layout/reftests/bugs/427017-1.xhtml b/layout/reftests/bugs/427017-1.xhtml
new file mode 100644
index 00000000000..f426dd95e86
--- /dev/null
+++ b/layout/reftests/bugs/427017-1.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-print">
+<body>
+<div style="position: absolute; border: 5px solid black;">
+  <div style="position: fixed; page-break-before: left;"/>
+  <div style="display: table-header-group; page-break-after: right;">
+    <div style="position: absolute;">
+      <div style="position: fixed;"/>
+    </div>
+  </div>
+  <div style="display: table-footer-group;"/>
+</div>
+</body>
+</html>
diff --git a/layout/reftests/bugs/reftest.list b/layout/reftests/bugs/reftest.list
index b4c53dbbdc3..9a4d51f36ca 100644
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@@ -797,3 +797,4 @@ fails-if(MOZ_WIDGET_TOOLKIT=="gtk2") == 424074-1-ref2.xul 424074-1-ref3.xul
 == 425972-1.html 425972-1-ref.html
 == 425972-2.html 425972-2-ref.html
 != 425972-1.html 425972-2.html
+!= 427017-1.xhtml about:blank    # crash test (needs reftest-print)