I've debugged this for a bit, but I'm not sure how to fix this in Gecko's style system. Basically, with my patch for bug 1389743, there's a single crashtest that asserts with the old style system. This crashtest is testing web-components stuff, and I'm not sure what the correct fix is supposed to be. In particular, we get a rule tree mismatch: r1 == r2 (must be in the same rule tree as parent) I've attached the restyle log. Look at how the parent style context is computed, but then we don't set the new style context, since we're going to reframe it. The parent style context comes from an IB split sibling[1]. Anyway, this is I think a web-component issue (because reframing the flattened tree parent doesn't imply reframing an abspos children that may inherit from it). And given that I think I'd like to annotate the crashtest with the assertion count. I'll attach a frame tree dump next. [1]: http://searchfox.org/mozilla-central/rev/c81edf03152b08b0f1d095c68b0dea7a5d7285ce/layout/generic/nsFrame.cpp#9437

(In reply to Emilio Cobos Álvarez [:emilio] from comment #0) > Anyway, this is I think a web-component issue (because reframing the > flattened tree parent doesn't imply reframing an abspos children that may > inherit from it). Well, this isn't exactly right, since this test-case doesn't exactly do that... We reframe one part of the IB split but not the next (well, we will, that's why this isn't a huge issue, but the RestyleManager doesn't know about that).

The assert ended up going away when tweaking bug 1389743 to not do reconstructs from ContentRemoved called from other sync frame construction async, so no need to block it... But I don't think there's anything in particular preventing this situation from happening, so I'll leave it open, feel free to close it if you think something like this can't happen.

This happens on layout/generic/crashtests/1059138-1.html, and I just updated the expectation count after talking w/ cam.