Found while fuzzing m-c 20241022-c47ccf99a981 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: !aFrame->HasLineClampEllipsis() (Should have been removed earlier), at /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2058

#0 0x796c9ee1838d in FindLineClampTarget /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2057:3
#1 0x796c9ee1838d in nsBlockFrame::ApplyLineClamp(int) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2111:21
#2 0x796c9ee172f0 in nsBlockFrame::ComputeFinalSize(mozilla::ReflowInput const&, mozilla::BlockReflowState&, mozilla::ReflowOutput&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2274:9
#3 0x796c9ee1169b in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2032:7
#4 0x796c9ee0f46b in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1564:9
#5 0x796c9ee3fd74 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:892:14
#6 0x796c9edd80d7 in mozilla::ScrollContainerFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:914:3
#7 0x796c9edd8b80 in mozilla::ScrollContainerFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1049:3
#8 0x796c9eddb02d in mozilla::ScrollContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1509:3
#9 0x796c9eeff993 in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:841:13
#10 0x796c9ee22f3f in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, GenericLineListIterator<nsLineLink, false>, nsIFrame*, LineReflowStatus*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:5119:15
#11 0x796c9ee21df2 in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, GenericLineListIterator<nsLineLink, false>, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4918:5
#12 0x796c9ee1df58 in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4775:9
#13 0x796c9ee1a2b8 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3743:24
#14 0x796c9ee1451f in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3247:29
#15 0x796c9ee10ef2 in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1930:35
#16 0x796c9ee0f46b in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1564:9
#17 0x796c9ee20a30 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, mozilla::CollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:290:11
#18 0x796c9ee1cb24 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4410:11
#19 0x796c9ee1a36d in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3740:5
#20 0x796c9ee1451f in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3247:29
#21 0x796c9ee10ef2 in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1930:35
#22 0x796c9ee0f46b in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1564:9
#23 0x796c9ee3fd74 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:892:14
#24 0x796c9ee3329f in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsCanvasFrame.cpp:710:7
#25 0x796c9ee3fd74 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:892:14
#26 0x796c9edd80d7 in mozilla::ScrollContainerFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:914:3
#27 0x796c9edd8b80 in mozilla::ScrollContainerFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1049:3
#28 0x796c9eddb02d in mozilla::ScrollContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1509:3
#29 0x796c9ee49ba1 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:933:14
#30 0x796c9ee04d70 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ViewportFrame.cpp:358:7
#31 0x796c9ecd6794 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9956:11
#32 0x796c9ecff55f in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:10126:22
#33 0x796c9ece024f in DoFlushLayout /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:10173:10
#34 0x796c9ece024f in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4396:9
#35 0x796c9cb3ef72 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1447:5
#36 0x796c9cb3ef72 in mozilla::EventStateManager::FlushLayout(nsPresContext*) /builds/worker/checkouts/gecko/dom/events/EventStateManager.cpp:6702:16
#37 0x796c9cb3b044 in mozilla::EventStateManager::PreHandleEvent(nsPresContext*, mozilla::WidgetEvent*, nsIFrame*, nsIContent*, nsEventStatus*, nsIContent*) /builds/worker/checkouts/gecko/dom/events/EventStateManager.cpp:1141:7
#38 0x796c9ecf880d in mozilla::PresShell::EventHandler::DispatchEvent(mozilla::EventStateManager*, mozilla::WidgetEvent*, bool, nsEventStatus*, nsIContent*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:8575:39
#39 0x796c9ecf1867 in mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo(mozilla::WidgetEvent*, nsEventStatus*, bool, nsIContent*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:8542:17
#40 0x796c9ecf103c in mozilla::PresShell::EventHandler::HandleEventUsingCoordinates(nsIFrame*, mozilla::WidgetGUIEvent*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:7342:30
#41 0x796c9ecefa78 in mozilla::PresShell::EventHandler::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:7146:12
#42 0x796c9eceee24 in mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:7089:23
#43 0x796c9e8ad88e in nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:652:18
#44 0x796c9e8ad5e9 in nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) /builds/worker/checkouts/gecko/view/nsView.cpp:1010:9
#45 0x796c9e8f096d in mozilla::widget::PuppetWidget::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) /builds/worker/checkouts/gecko/widget/PuppetWidget.cpp:311:37
#46 0x796c9a4b354b in mozilla::layers::APZCCallbackHelper::DispatchWidgetEvent(mozilla::WidgetGUIEvent&) /builds/worker/checkouts/gecko/gfx/layers/apz/util/APZCCallbackHelper.cpp:508:21
#47 0x796c9e10eca2 in DispatchWidgetEventViaAPZ /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1705:10
#48 0x796c9e10eca2 in mozilla::dom::BrowserChild::HandleRealMouseButtonEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1662:3
#49 0x796c9e1103fb in mozilla::dom::BrowserChild::RecvRealMouseButtonEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1615:3
#50 0x796c9e110568 in mozilla::dom::BrowserChild::RecvSynthMouseMoveEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1580:8
#51 0x796c9e242ed5 in mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBrowserChild.cpp:5634:80
#52 0x796c9e2b5be0 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:9666:32
#53 0x796c99c9cd2f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1726:25
#54 0x796c99c99cb2 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1653:9
#55 0x796c99c9a932 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1444:3
#56 0x796c99c9ba7f in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1544:14
#57 0x796c9910c5e7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:618:16
#58 0x796c99102076 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:945:26
#59 0x796c99100a87 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:768:15
#60 0x796c99100f05 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:554:36
#61 0x796c9910ff56 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:268:37
#62 0x796c9910ff56 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#63 0x796c9912366b in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1155:16
#64 0x796c9912a34f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#65 0x796c99ca28b5 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#66 0x796c99bf5a81 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#67 0x796c99bf5a81 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#68 0x796c9e9171d8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#69 0x796c9e9c5018 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:469:33
#70 0x796c9f89d47b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:651:20
#71 0x796c99ca3706 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#72 0x796c99bf5a81 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#73 0x796c99bf5a81 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#74 0x796c9f89c89a in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:586:34
#75 0x59cc4206706e in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:398:22

This has been detected by live site testing.

Verified bug as reproducible on mozilla-central 20241024094434-7936ca01a900.
The bug appears to have been introduced in the following build range:

Start: c26db48e3da8f014588711847dbada59709a501a (20241021105023)
End: e3ad21dfdd4b1da3c36f1533f93f5c6ecc9a462d (20241021113448)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=c26db48e3da8f014588711847dbada59709a501a&tochange=e3ad21dfdd4b1da3c36f1533f93f5c6ecc9a462d

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

A pernosco session for this bug can be found here.

Set release status flags based on info from the regressing bug 1791226

Hey Jonathan, I am the REO for Fx133 and I am checking in because this bug is marked affecting Fx133. I see there is no priority and severity set for this bug. How critical is it to get this fixed? Please note that last day for Beta uplifts is Nov 15th. Please let me know. Thank you!

I'm not sure the regression range in comment 2 is correct; simply loading the testcase in a local debug build on macOS, the assertion reproduces with c26db48e3da8f014588711847dbada59709a501a, which is the start of that range.

I tried this on Windows and confirmed that bug 1791226 does regress it there; prior to that bug, the testcase doesn't assert, and after cf9f54eef33465d089f850a55da5734a911fdac4 landed, it does. So that corresponds with the reported regression range.

However, given that on macOS the assertion occurs even before bug 1791226, I suspect this is a pre-existing flaw that just happened to be exposed (on Windows and Linux) by that change, not really caused by it.

Possibly related: bug 1808814.

This is a slightly more simplified version of the testcase. Tryserver confirms that this hits the same assertion (across all platforms) using a base revision of c26db48e3da8f014588711847dbada59709a501a, i.e. before the regression range noted in comment 2.

Using the testcase from comment 9, the relevant part of the resulting frame tree looks like this:

Block(div id=a)(0)@103046b58 parent=103046a48 (x=0, y=0, w=0, h=0) [content=10bf0c700] [cs=10bc25908] <
  line@1030472c8 count=1 state=inline,clean,prevmarginclean,not-impacted,not-wrapped,no-break,clear-before:none,clear-after:none(x=0, y=0, w=22.2, h=19.2) ink-overflow=(x=-0.5, y=0, w=23.2, h=19.2) scr-overflow=(x=0, y=0, w=22.2, h=19.2) <
    Text(0)"abc"@103046c18 parent=103046b58 next=103046cb8 (x=0, y=1.6, w=22.2, h=16) ink-overflow=(x=-0.5, y=0, w=23.2, h=16) scr-overflow=(x=0, y=0, w=22.2, h=16) [content=10bf0c780] [cs=10bc25508:-moz-text] [run=10ab54970][0,3,T] 
  >
  line@103047318 count=1 state=block,clean,prevmarginclean,not-impacted,not-wrapped,no-break,clear-before:none,clear-after:none(x=0, y=19.2, w=59.4167, h=21.2) ink-overflow=(x=-0.5, y=19.2, w=60.4167, h=21.2) scr-overflow=(x=0, y=19.2, w=59.4167, h=21.2) <
    Block(details)(1)@103046cb8 parent=103046b58 (x=0, y=19.2, w=59.4167, h=21.2) ink-overflow=(x=-0.5, y=0, w=60.4167, h=21.2) scr-overflow=(x=0, y=0, w=59.4167, h=21.2) [content=10bf18070] [cs=10bc25c08] <
      line@103047228 count=1 state=block,clean,prevmarginclean,not-impacted,not-wrapped,no-break,clear-before:none,clear-after:none(x=0, y=0, w=59.4167, h=21.2) ink-overflow=(x=-0.5, y=0, w=60.4167, h=21.2) scr-overflow=(x=0, y=0, w=59.4167, h=21.2) <
        Block(summary)(0)@103046d78 parent=103046cb8 next=103047078 (x=0, y=0, w=59.4167, h=21.2) ink-overflow=(x=-0.5, y=0, w=60.4167, h=21.2) [content=10bf0c800] [cs=10bc26008] <
          line@103047028 count=2 state=inline,clean,prevmarginclean,not-impacted,not-wrapped,no-break,clear-before:none,clear-after:none(x=0, y=0, w=59.4167, h=21.2) ink-overflow=(x=-0.5, y=0, w=60.4167, h=21.2) scr-overflow=(x=0, y=0, w=59.4167, h=21.2) <
            Inline(_moz_generated_content_marker)(-1)@103046e38 parent=103046d78 next=103046f88 (x=0, y=2.6, w=14.0833, h=14) ink-overflow=(x=-0.5, y=0, w=15.0833, h=14) scr-overflow=(x=0, y=0, w=14.0833, h=14) [content=10bf0ca00] [cs=10bc26108:marker] <
              Text(0)"\u25b8 "@103046ee8 parent=103046e38 (x=0, y=0, w=14.0833, h=14) ink-overflow=(x=-0.5, y=0, w=15.0833, h=14) [content=10bf0ca80] [cs=10bc26208:-moz-text] [run=10bc5d480][0,2,T] 
            >
            Text(0)"Details"@103046f88 parent=103046d78 (x=14.0833, y=3.6, w=45.3333, h=16) ink-overflow=(x=-0.5, y=0, w=46.3333, h=16) scr-overflow=(x=0, y=0, w=45.3333, h=16) [content=10bf0c880] [cs=10bc26308:-moz-text] [run=10bc34e00][0,7,T] 
          >
        >
      >
      line@103047278 count=1 state=block,clean,prevmarginclean,not-impacted,not-wrapped,no-break,clear-before:none,clear-after:none(x=0, y=21.2, w=59.4167, h=0) <
        Block(slot)(2)@103047078 parent=103046cb8 (x=0, y=21.2, w=59.4167, h=0) [content=10bf14220] [cs=10bc25f08] [content-visibility=hiden, HidesContent=hidden] <
          line@1030471d8 count=1 state=inline,clean,prevmarginclean,not-impacted,not-wrapped,no-break,clear-before:none,clear-after:none(x=0, y=0, w=0, h=0) <
            Text(0)"foo"@103047138 parent=103047078 (x=0, y=0, w=0, h=0) [content=10bf0c900] [cs=10bc26408:-moz-text] [run=0][0,3,T] 
          >
        >
      >
    >
  >
>

When we reflow this frame tree, the sequence of events goes something like this:

• Start reflowing the Block(div id=a), which is the line-clamp root, and clear the old ellipsis setting on it
  • Recurse into reflowing Block(details)
    • Recurse into reflowing Block(summary)
    • While finishing Block(summary), we call ApplyLineClamp, which will find the line-clamp root frame Block(div id=a) and set the ellipsis on it
  • While finishing Block(details), we again call ApplyLineClamp, which will find the same line-clamp root, but because the ellipsis has already been set on that root frame by our child, FindLineClampTarget will assert.
• Then while finishing Block(div id=a), the same assertion fires again, because the ellipsis was already set up by our descendants.

One simple idea here would be to call ClearLineClampEllipsis later in block-frame reflow, after the children have been reflowed and just before calling ComputeFinalSize, which will apply the new line-clamp as needed. This would fix the assertion we're hitting while reflowing the line-clamp root frame Block(div id=a) because its children already applied the ellipsis. However, it wouldn't resolve the issue that the ellipsis is actually being applied twice by different levels of descendants: summary sets it (on the root), and then details wants to re-apply it to the same root.

So I think the assertion in FindLineClampTarget is a bit too strict: it doesn't allow for the fact that there may be multiple levels of descendant frames that call ApplyLineClamp and end up targeting the same line-clamp root.

No change in behavior.

Thanks for getting to this Jonathan!

https://hg.mozilla.org/mozilla-central/rev/903b79dc3e7f
https://hg.mozilla.org/mozilla-central/rev/4808879a4bfe
https://hg.mozilla.org/mozilla-central/rev/cbdf6502783c

Verified bug as fixed on rev mozilla-central 20241111213954-4e75481ca263.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.