Reduced with m-c:
BuildID=20190722093634
SourceStamp=db8f3ee41bdf525db2d0e5816d26ee654ab6ec7e

Assertion failure: found (not in child list), at src/layout/base/nsLayoutUtils.cpp:1465

#0 nsLayoutUtils::GetChildListNameFor(nsIFrame*) src/layout/base/nsLayoutUtils.cpp:1465:5
#1 nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) src/layout/base/nsCSSFrameConstructor.cpp:7691:17
#2 nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) src/layout/base/nsCSSFrameConstructor.cpp:8725:7
#3 mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) src/layout/base/RestyleManager.cpp:1558:25
#4 mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) src/layout/base/RestyleManager.cpp:3103:9
#5 mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) src/layout/base/PresShell.cpp:4188:39
#6 nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1959:22
#7 mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:327:7
#8 mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:344:5
#9 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:710:16
#10 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:605:9
#11 mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:65:16
#12 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:187:54
#13 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:4821:32
#14 mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2184:25
#15 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2108:9
#16 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1955:3
#17 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1986:13
#18 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1225:14
#19 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
#20 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:110:5
#21 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#22 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#23 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#24 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:919:20
#25 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
#26 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#27 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#28 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:754:34
#29 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#30 main src/browser/app/nsBrowserApp.cpp:267:18

I have a reduced test case which demonstrates a wrong frame tree when column-span is enabled. It has height:0 and font-size:0, so almost all of the frames are overflow incomplete. We create a lot of next-in-flows, and put them in OverflowList, ExcessOverflowContainersList. It seems that we don't handle fragmentation for Canvas(html) in a continuous context.

I feel the original testcase is unlikely to happen in the real webpage, and it doesn't crash nightly. It also seems hard to fix given the analysis in comment 1, so make it P5.

This is fixed by bug 1420528. Mozregression finds this range
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a4c06043401d88a5c7b33277abfa794a10636e1c&tochange=a5d545e31781b28dfc37020e0b622377288d17bd

I'll add both the original test case and my reduced one as crashtests.

https://hg.mozilla.org/mozilla-central/rev/a8646f9a5ab1