Thanks Tyson. I can reproduce with the test case in comment 4. When the assertion triggered, I saw there is a lingered "overflow-line" containing a column container, which means we do something wrong when fragmenting multi-column. I'll take a look.
Bug 1582019 Comment 5 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Thanks Tyson. I can reproduce with the test case in comment 4. When the assertion triggered, I saw there is a lingered "overflow-line" containing a column container in the frame tree dump in my local rr session, which means we do something wrong when fragmenting multi-column. I'll take a look.