Created attachment 713173 [details] testcase (crashes Firefox when loaded) ###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file ../../../layout/base/nsLayoutUtils.cpp, line 4808 ###!!! ASSERTION: Placeholder relationship should have been torn down already; this might mean we have a stray placeholder in the tree.: '!placeholder || nsLayoutUtils::IsProperAncestorFrame(aDestructRoot, placeholder)', file ../../../layout/generic/nsFrame.cpp, line 633 ###!!! ASSERTION: Null out-of-flow for placeholder?: 'outOfFlow', file ../../../layout/base/../generic/nsPlaceholderFrame.h, line 162 This might just be another symptom of bug 600100.
FYI The testcase attachment 713173 [details] crashes. (see Bug 772320 Comment#12 and regressed by Bug 751012)
Testcase works for me in a local m-c debug build on Linux64, without any assertions, and also works in an ASan build.