Bug 1663232 - Don't delete a child's next-in-flow if it's going to be reflow again due to clearance. r=emilio

After this patch, the testcase still triggers soft assertions like

  ASSERTION: Placeholder relationship should have been torn down already;
  this might mean we have a stray placeholder in the tree.

We have multiple bugs filed for this assertions such as bug 856269.

Differential Revision: https://phabricator.services.mozilla.com/D90760

layout/generic/nsBlockReflowContext.cpp

@@ -313,11 +313,13 @@ void nsBlockReflowContext::ReflowBlock(
   }
 
   if (!aFrameReflowStatus.IsInlineBreakBefore() &&
+      !aFrameRI.WillReflowAgainForClearance() &&
       aFrameReflowStatus.IsFullyComplete()) {
-    // If frame is complete and has a next-in-flow, we need to delete
-    // them now. Do not do this when a break-before is signaled because
-    // the frame is going to get reflowed again (whether the frame is
-    // (in)complete is undefined in that case anyway).
+    // If mFrame is fully-complete and has a next-in-flow, we need to delete
+    // them now. Do not do this when a break-before is signaled or when a
+    // clearance frame is discovered in mFrame's subtree because mFrame is going
+    // to get reflowed again (whether the frame is (in)complete is undefined in
+    // that case anyway).
     if (nsIFrame* kidNextInFlow = mFrame->GetNextInFlow()) {
       // Remove all of the childs next-in-flows. Make sure that we ask
       // the right parent to do the removal (it's possible that the

testing/web-platform/tests/css/CSS2/floats-clear/clearance-containing-fragmented-float-crash.html

@@ -0,0 +1,36 @@
+<!-- quirks mode -->
+<meta charset="utf-8">
+<title>Should not crash when a clearance frame having a fragmented float is discovered</title>
+<link rel="author" title="Ting-Yu Lin" href="mailto:tlin@mozilla.com">
+<link rel="author" title="Mozilla" href="https://www.mozilla.org/">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1663232">
+
+<style>
+:not(em) {
+  border-left: 4px dashed green;
+  column-width: 0;
+}
+</style>
+<script>
+function go() {
+  b.appendChild(a)
+}
+</script>
+<m>
+<details ontoggle="go()" open>
+<f>
+<menu>U<menu>
+<table align="RIGHT">
+<caption>
+<o>
+<ul>
+<l>
+<li>
+<tr>6
+<table>
+<a>
+<details id="b" open>
+<summary>
+<i id="a">
+</summary>
+<details style="float: right">