Found while fuzzing m-c 20241101-8301e6902b9a (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Frame property OutsideMarkerProperty should never be destroyed by the FrameProperties class), at /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:422

#0 0x75fecfb7c46d in AssertOnDestroyingPropertyOutsideMarkerProperty /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:422:1
#1 0x75fecfb7c46d in void mozilla::FramePropertyDescriptor<nsFrameList>::Destruct<&AssertOnDestroyingPropertyOutsideMarkerProperty(nsFrameList*)>(void*) /builds/worker/checkouts/gecko/layout/base/FrameProperties.h:91:5
#2 0x75fecfa55835 in DestroyValueFor /builds/worker/checkouts/gecko/layout/base/FrameProperties.h:323:9
#3 0x75fecfa55835 in mozilla::FrameProperties::RemoveAll(nsIFrame const*) /builds/worker/checkouts/gecko/layout/base/FrameProperties.h:256:12
#4 0x75fecfa1b96e in RemoveAllProperties /builds/worker/checkouts/gecko/layout/generic/nsIFrame.h:4450:44
#5 0x75fecfa1b96e in mozilla::PresShell::NotifyDestroyingFrame(nsIFrame*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:2206:13
#6 0x75fecfbf4a1f in nsIFrame::Destroy(mozilla::FrameDestroyContext&) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:864:7
#7 0x75fecfb89edb in nsContainerFrame::Destroy(mozilla::FrameDestroyContext&) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:301:22
#8 0x75fecfb6c353 in nsBlockFrame::DoRemoveFrame(mozilla::FrameDestroyContext&, nsIFrame*, unsigned int) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7090:20
#9 0x75fecfb6baf0 in nsBlockFrame::RemoveFrame(mozilla::FrameDestroyContext&, mozilla::FrameChildListID, nsIFrame*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:6253:5
#10 0x75fecfa8eb70 in nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7550:5
#11 0x75fecfa89f3b in nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8472:7
#12 0x75fecfa4a800 in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:1680:25
#13 0x75fecfa51664 in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3284:7
#14 0x75fecfa24835 in mozilla::RestyleManager::ProcessPendingRestyles() /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3370:3
#15 0x75fecfa23b86 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4416:37
#16 0x75fecd837bf2 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1447:5
#17 0x75fecd837bf2 in mozilla::EventStateManager::FlushLayout(nsPresContext*) /builds/worker/checkouts/gecko/dom/events/EventStateManager.cpp:6701:16
#18 0x75fecd833c44 in mozilla::EventStateManager::PreHandleEvent(nsPresContext*, mozilla::WidgetEvent*, nsIFrame*, nsIContent*, nsEventStatus*, nsIContent*) /builds/worker/checkouts/gecko/dom/events/EventStateManager.cpp:1141:7
#19 0x75fecfa3c1ed in mozilla::PresShell::EventHandler::DispatchEvent(mozilla::EventStateManager*, mozilla::WidgetEvent*, bool, nsEventStatus*, nsIContent*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:8605:39
#20 0x75fecfa35247 in mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo(mozilla::WidgetEvent*, nsEventStatus*, bool, nsIContent*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:8572:17
#21 0x75fecfa34a23 in mozilla::PresShell::EventHandler::HandleEventUsingCoordinates(nsIFrame*, mozilla::WidgetGUIEvent*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:7372:30
#22 0x75fecfa33458 in mozilla::PresShell::EventHandler::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:7176:12
#23 0x75fecfa32804 in mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:7119:23
#24 0x75fecf5ee65e in nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:652:18
#25 0x75fecf5ee3b9 in nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) /builds/worker/checkouts/gecko/view/nsView.cpp:1010:9
#26 0x75fecf63239d in mozilla::widget::PuppetWidget::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) /builds/worker/checkouts/gecko/widget/PuppetWidget.cpp:311:37
#27 0x75fecb17d9fb in mozilla::layers::APZCCallbackHelper::DispatchWidgetEvent(mozilla::WidgetGUIEvent&) /builds/worker/checkouts/gecko/gfx/layers/apz/util/APZCCallbackHelper.cpp:508:21
#28 0x75fecee3ba62 in DispatchWidgetEventViaAPZ /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1705:10
#29 0x75fecee3ba62 in mozilla::dom::BrowserChild::HandleRealMouseButtonEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1662:3
#30 0x75fecee3d1bb in mozilla::dom::BrowserChild::RecvRealMouseButtonEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1615:3
#31 0x75fecee3d328 in mozilla::dom::BrowserChild::RecvSynthMouseMoveEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1580:8
#32 0x75fecef722c7 in mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBrowserChild.cpp:5470:80
#33 0x75fecefe6c50 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8826:32
#34 0x75feca9595ef in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1726:25
#35 0x75feca956572 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1653:9
#36 0x75feca9571f2 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1444:3
#37 0x75feca95833f in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1544:14
#38 0x75fec9db1dc7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:618:16
#39 0x75fec9da7629 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:945:26
#40 0x75fec9da6067 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:768:15
#41 0x75fec9da64e5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:554:36
#42 0x75fec9db5809 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:271:37
#43 0x75fec9db5809 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#44 0x75fec9dc90cb in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1155:16
#45 0x75fec9dcfdaf in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#46 0x75feca95f123 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107:5
#47 0x75feca8b1561 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#48 0x75feca8b1561 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#49 0x75fecf658c48 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#50 0x75fecf70aea8 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:469:33
#51 0x75fed05f025b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:651:20
#52 0x75feca95ffc6 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#53 0x75feca8b1561 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#54 0x75feca8b1561 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#55 0x75fed05ef67a in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:586:34
#56 0x56052f6d8e9e in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:397:22

Verified bug as reproducible on mozilla-central 20241112214908-aef84d293121.
The bug appears to have been introduced in the following build range:

Start: 0b827f74c25bbee67028a72d5002eb06dee92e65 (20241018135540)
End: 46e3983957d4ca2860c5e916639bda343f705759 (20241018135848)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=0b827f74c25bbee67028a72d5002eb06dee92e65&tochange=46e3983957d4ca2860c5e916639bda343f705759

Set release status flags based on info from the regressing bug 1791226

:emilio, since you are the author of the regressor, bug 1791226, could you take a look?

For more information, please visit BugBot documentation.

No change in observable behavior.

https://hg.mozilla.org/mozilla-central/rev/4b45dbb1fb47
https://hg.mozilla.org/mozilla-central/rev/3edc20736e2a
https://hg.mozilla.org/mozilla-central/rev/ae6f06e41db3

Verified bug as fixed on rev mozilla-central 20241116092601-8cdd018168b0.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.