Note there is bug 1427792 open for the same assert, so the problem could be similar/related.
Bug 1649668 Comment 20 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Note there is bug 1427792 open for the same assert, so the problem could be similar/related. This testcase has clippath and fixed position. Any time we have a clippath that affects a placeholder for a fixed frame we are probably going to have a bad time because the content clip chain will have an asr from the non-fixed frame tree, and the containing block clip inside the fixed subtree will be unrelated to that asr.