Found while fuzzing m-c 20210417-4f124a8d83d1 (--enable-address-sanitizer --enable-fuzzing)

==36707==ERROR: AddressSanitizer: use-after-poison on address 0x62500019e12d at pc 0x7f41b3a9ee46 bp 0x7ffdb3779eb0 sp 0x7ffdb3779ea8
READ of size 1 at 0x62500019e12d thread T0 (Isolated Web Co)
    #0 0x7f41b3a9ee45 in IsFieldSetFrame /builds/worker/workspace/obj-build/dist/include/mozilla/FrameTypeList.h:58:1
    #1 0x7f41b3a9ee45 in nsIFrame::IsRenderedLegend() const /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:635:53
    #2 0x7f41b3822d13 in nsCSSFrameConstructor::MaybeRecreateContainerForFrameRemoval(nsIFrame*) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8205:20
    #3 0x7f41b3821c8f in nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7371:9
    #4 0x7f41b3821ea0 in nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7350:31
    #5 0x7f41b3821ea0 in nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7350:31
    #6 0x7f41b3816eb7 in nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8464:7
    #7 0x7f41b37b3c60 in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:1503:25
    #8 0x7f41b37bcec3 in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3048:9
    #9 0x7f41b3783df1 in ProcessPendingRestyles /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3127:3
    #10 0x7f41b3783df1 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4202:39
    #11 0x7f41aeda4747 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1406:5
    #12 0x7f41aeda4747 in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/dom/base/Document.cpp:10556:16
    #13 0x7f41aede3998 in FlushPendingNotifications /builds/worker/checkouts/gecko/dom/base/Document.cpp:10477:3
    #14 0x7f41aede3998 in GetPrimaryFrame /builds/worker/checkouts/gecko/dom/base/Element.cpp:250:10
    #15 0x7f41aede3998 in mozilla::dom::Element::GetScrollFrame(nsIFrame**, mozilla::FlushType) /builds/worker/checkouts/gecko/dom/base/Element.cpp:620:21
    #16 0x7f41aede6619 in mozilla::dom::Element::GetClientAreaRect() /builds/worker/checkouts/gecko/dom/base/Element.cpp:973:32
    #17 0x7f41b0557c16 in ClientHeight /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Element.h:1328:35
    #18 0x7f41b0557c16 in mozilla::dom::Element_Binding::get_clientHeight(JSContext*, JS::Handle<JSObject*>, void*, JSJitGetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/ElementBinding.cpp:3642:39
    #19 0x7f41b0943502 in bool mozilla::dom::binding_detail::GenericGetter<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3114:13
    #20 0x7f41b6fa75f4 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:437:13
    #21 0x7f41b6fa75f4 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:522:12
    #22 0x7f41b6fa9419 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:582:10
    #23 0x7f41b6fa969b in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:599:8
    #24 0x7f41b78178a2 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jsapi.cpp:2830:10
    #25 0x7f41ad7ead0f in Call /builds/worker/workspace/obj-build/dist/include/jsapi.h:1472:10
    #26 0x7f41ad7ead0f in xpc::XrayWrapper<js::CrossCompartmentWrapper, xpc::DOMXrayTraits>::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) const /builds/worker/checkouts/gecko/js/xpconnect/wrappers/XrayWrapper.cpp:2086:10
    #27 0x7f41b7167ab6 in getInternal /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:483:19
    #28 0x7f41b7167ab6 in js::Proxy::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:491:10
    #29 0x7f41b7167c19 in getInternal /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:479:14
    #30 0x7f41b7167c19 in js::Proxy::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:491:10
    #31 0x7f41b7167c19 in getInternal /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:479:14
    #32 0x7f41b7167c19 in js::Proxy::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:491:10
    #33 0x7f41b7167c19 in getInternal /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:479:14
    #34 0x7f41b7167c19 in js::Proxy::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:491:10
    #35 0x7f41b6fb0cc6 in GetProperty /builds/worker/checkouts/gecko/js/src/vm/ObjectOperations-inl.h:113:12
    #36 0x7f41b6fb0cc6 in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, js::PropertyName*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/ObjectOperations-inl.h:123:10
    #37 0x7f41b6fb01b2 in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:4563:10
    #38 0x7f41b6f91dcf in GetPropertyOperation /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:219:10
    #39 0x7f41b6f91dcf in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:2939:12
    #40 0x7f41b6f7722e in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:406:13
    #41 0x7f41b6fa7733 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:554:13
    #42 0x7f41b6fa9419 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:582:10
    #43 0x7f41b7e5b63c in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jit/BaselineIC.cpp:1843:10
    #44 0x3cfc4374cd27  (<unknown module>)

0x62500019e12d is located 6189 bytes inside of 8192-byte region [0x62500019c900,0x62500019e900)
allocated by thread T0 (Isolated Web Co) here:
    #0 0x559c2e6b174d in malloc /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x7f41ab962d00 in mozilla::ArenaAllocator<8192ul, 8ul>::AllocateChunk(unsigned long) /builds/worker/workspace/obj-build/dist/include/mozilla/ArenaAllocator.h:170:15
    #2 0x7f41b38b08ad in InternalAllocate /builds/worker/workspace/obj-build/dist/include/mozilla/ArenaAllocator.h:204:25
    #3 0x7f41b38b08ad in Allocate /builds/worker/workspace/obj-build/dist/include/mozilla/ArenaAllocator.h:66:12
    #4 0x7f41b38b08ad in mozilla::ArenaAllocator<8192ul, 8ul>::Allocate(unsigned long) /builds/worker/workspace/obj-build/dist/include/mozilla/ArenaAllocator.h:70:15
    #5 0x7f41b3bc12c5 in AllocateByObjectID /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:271:32
    #6 0x7f41b3bc12c5 in AllocateFrame /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:263:12
    #7 0x7f41b3bc12c5 in operator new /builds/worker/checkouts/gecko/layout/generic/nsTextFrame.cpp:4621:1
    #8 0x7f41b3bc12c5 in NS_NewTextFrame(mozilla::PresShell*, mozilla::ComputedStyle*) /builds/worker/checkouts/gecko/layout/generic/nsTextFrame.cpp:4618:10
    #9 0x7f41b380dedc in nsCSSFrameConstructor::ConstructTextFrame(nsCSSFrameConstructor::FrameConstructionData const*, nsFrameConstructorState&, nsIContent*, nsContainerFrame*, mozilla::ComputedStyle*, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:3207:7
    #10 0x7f41b3816974 in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:5551:5
    #11 0x7f41b3800a36 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:9366:5
    #12 0x7f41b3811f7c in nsCSSFrameConstructor::ConstructInline(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:10804:3
    #13 0x7f41b380f007 in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:3575:16
    #14 0x7f41b3816748 in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:5564:3
    #15 0x7f41b3800a36 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:9366:5
    #16 0x7f41b380177b in nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, bool, nsFrameList&, bool, nsIFrame*) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:9531:3
    #17 0x7f41b3807448 in nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, nsContainerFrame*, mozilla::ComputedStyle*, nsContainerFrame**, nsFrameList&, nsIFrame*) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:10411:3
    #18 0x7f41b380d7da in nsCSSFrameConstructor::ConstructNonScrollableBlockWithConstructor(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameList&, nsBlockFrame* (*)(mozilla::PresShell*, mozilla::ComputedStyle*)) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:4515:3
    #19 0x7f41b3812557 in nsCSSFrameConstructor::ConstructNonScrollableBlock(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:4486:10
    #20 0x7f41b380f007 in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:3575:16
    #21 0x7f41b3816748 in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:5564:3
    #22 0x7f41b3800a36 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:9366:5
    #23 0x7f41b380177b in nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, bool, nsFrameList&, bool, nsIFrame*) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:9531:3
    #24 0x7f41b3807448 in nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, nsContainerFrame*, mozilla::ComputedStyle*, nsContainerFrame**, nsFrameList&, nsIFrame*) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:10411:3

A Pernosco session is available here: https://pernos.co/debug/-6ukewnEb1R5caunXyppPg/index.html

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210501093251-cd81489560e4.
Failed to bisect testcase (Testcase reproduces on start build!):

Start: 5daf558349272b05cee2c9097a9499ff4d7363e6 (20200502094855)
End: 4f124a8d83d125b2f95fb6f9c6adc2b947dc6bfb (20210417095008)
BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=True, coverage=False, valgrind=False)

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210501093251-cd81489560e4.
Failed to bisect testcase (Testcase reproduces on start build!):

Start: 5daf558349272b05cee2c9097a9499ff4d7363e6 (20200502094855)
End: 4f124a8d83d125b2f95fb6f9c6adc2b947dc6bfb (20210417095008)
BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=True, coverage=False, valgrind=False)

Bugmon Analysis
The bug appears to have been fixed in the following build range:

Start: 57328f12e67aafad12fd1f062fddf48b41120a4f (20210614004220)
End: e77eb14241b9e712ddda1e8c1cc21ef455377e3c (20210614070416)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=57328f12e67aafad12fd1f062fddf48b41120a4f&tochange=e77eb14241b9e712ddda1e8c1cc21ef455377e3c
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.