User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36

Steps to reproduce:

open the attached html file with firefox debug version.

Actual results:

the firefox crashed.
log:
Assertion failure: IsAncestor(aOne, aTwo) || IsAncestor(aTwo, aOne), at /builds/worker/workspace/obj-build/dist/include/nsDisplayList.h:204
#01: ??? mozilla::ActiveScrolledRoot::PickDescendant(mozilla::ActiveScrolledRoot const*, mozilla::ActiveScrolledRoot const*)
#02: ??? mozilla::nsDisplayListBuilder::CreateClipChainIntersection(mozilla::DisplayItemClipChain const*, mozilla::DisplayItemClipChain const*, mozilla::DisplayItemClipChain const*)
#03: ??? mozilla::DisplayListClipState::GetCurrentCombinedClipChain(mozilla::nsDisplayListBuilder*)
#04: ??? mozilla::nsDisplayListBuilder::MarkFramesForDisplayList(nsIFrame*, nsFrameList const&)
#05: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#06: ??? mozilla::ScrollFrameHelper::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#07: ??? nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
#08: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#09: ??? DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
#10: ??? nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#11: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#12: ??? mozilla::ScrollFrameHelper::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#13: ??? nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
#14: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#15: ??? DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
#16: ??? nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#17: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#18: ??? mozilla::ScrollFrameHelper::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#19: ??? nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
#20: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#21: ??? DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
#22: ??? nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#23: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#24: ??? mozilla::ScrollFrameHelper::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#25: ??? nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
#26: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#27: ??? DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
#28: ??? nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#29: ??? nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
#30: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#31: ??? nsCanvasFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#32: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#33: ??? mozilla::ScrollFrameHelper::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#34: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#35: ??? mozilla::ViewportFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#36: ??? nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
#37: ??? nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags)
#38: ??? mozilla::PresShell::PaintInternal(nsView*, mozilla::PaintInternalFlags)
#39: ??? nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*)
#40: ??? nsViewManager::ProcessPendingUpdatesForView(nsView*, bool)
#41: ??? nsViewManager::ProcessPendingUpdates()
#42: ??? nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)
#43: ??? mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)
#44: ??? mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)
#45: ??? mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)
#46: ??? mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)
#47: ??? mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&)
#48: ??? mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread()
#49: ??? mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&)
#50: ??? mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&)
#51: ??? mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&)
#52: ??? mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&)
#53: ??? mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)
#54: ??? mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >)
#55: ??? mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&)
#56: ??? mozilla::ipc::MessageChannel::MessageTask::Run()
#57: ??? mozilla::RunnableTask::Run()
#58: ??? mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
#59: ??? mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
#60: ??? mozilla::TaskController::ProcessPendingMTTask(bool)
#61: ??? mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_2>::Run()
#62: ??? nsThread::ProcessNextEvent(bool, bool*)
#63: ??? NS_ProcessNextEvent(nsIThread*, bool)
#64: ??? mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)
#65: ??? MessageLoop::RunInternal()
#66: ??? MessageLoop::Run()
#67: ??? nsBaseAppShell::Run()
#68: ??? XRE_RunAppShell()
#69: ??? mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)
#70: ??? MessageLoop::RunInternal()
#71: ??? MessageLoop::Run()
#72: ??? XRE_InitChildProcess(int, char**, XREChildData const*)
#73: ??? content_process_main(mozilla::Bootstrap*, int, char**)
#74: ??? main
#75: __libc_start_main __libc_start_main
#76: ??? _start
#77: ??? (???:???)

Expected results:

the firefox should not crash.

I didn't experience any crash while loading the attachment in the latest Nightly 113.0a1 and Firefox 111.0.1 versions.
Does this issue occur frequently on your side?
Are you able to reproduce this issue using Firefox in safe mode or with a new profile?

I opened it on the Ubuntu 22.04 and I added a screen recording in the attachment.

Thanks for the details provided.
Setting the component to have the developer's opinion about it.
If this is not the correct component, please feel free to change it to a more appropriate one.