Here's the backtrace of the fatal assertion failure. Notably, we've got ScrollAnchorContainer::ApplyAdjustments at stacklevel 60, calling ScrollTo() to apply an adjustment, which then triggers nsDocShell::NotifyScrollObserver, which in this case causes us to flush layout & recreate frames for some reason, including calling nsHTMLScrollFrame::DestroyFrom on presumably the same scrollframe whose adjustment we're still in the process of applying. So by the time we pop back up to stacklevel 60, 'this' will probably be a deleted pointer anyway. (But we get into trouble before that, as noted by the hashtable assertion failure.)
Bug 1525509 Comment 7 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Here's the backtrace of the fatal assertion failure. Notably, we've got ScrollAnchorContainer::ApplyAdjustments at stacklevel 60, calling ScrollTo() to apply an adjustment, which then triggers nsDocShell::NotifyScrollObserver, which in this case causes us to flush layout & recreate frames for some reason, including calling nsHTMLScrollFrame::DestroyFrom on maybe even the same scrollframe whose adjustment we're still in the process of applying. So by the time we pop back up to stacklevel 60, 'this' will probably be a deleted pointer anyway. (But we get into trouble before that, as noted by the hashtable assertion failure.)