diff --git a/dom/base/ShadowRoot.cpp b/dom/base/ShadowRoot.cpp
index 03584ada9208..c16fbc7660a0 100644
--- a/dom/base/ShadowRoot.cpp
+++ b/dom/base/ShadowRoot.cpp
@@ -244,9 +244,10 @@ ShadowRoot::RemoveDestInsertionPoint(nsIContent* aInsertionPoint,
int32_t index = aDestInsertionPoints.IndexOf(aInsertionPoint);
// It's possible that we already removed the insertion point while processing
- // other insertion point removals.
+ // other insertion point removals / fallback content redistribution (which
+ // does DestInsertionPoints().Clear()).
if (index >= 0) {
- aDestInsertionPoints.SetLength(index);
+ aDestInsertionPoints.RemoveElementAt(index);
}
}
diff --git a/layout/base/ServoRestyleManager.cpp b/layout/base/ServoRestyleManager.cpp
index a2eb8572e20b..1b0a8bb88770 100644
--- a/layout/base/ServoRestyleManager.cpp
+++ b/layout/base/ServoRestyleManager.cpp
@@ -1207,9 +1207,30 @@ ServoRestyleManager::DoProcessPendingRestyles(ServoTraversalFlags aFlags)
mAnimationsWithDestroyedFrame->StopAnimationsForElementsWithoutFrames();
}
+#ifdef DEBUG
+static void
+VerifyFlatTree(const nsIContent& aContent)
+{
+ StyleChildrenIterator iter(&aContent);
+
+ for (auto* content = iter.GetNextChild();
+ content;
+ content = iter.GetNextChild()) {
+ MOZ_ASSERT(content->GetFlattenedTreeParentNodeForStyle() == &aContent);
+ VerifyFlatTree(*content);
+ }
+}
+#endif
+
void
ServoRestyleManager::ProcessPendingRestyles()
{
+#ifdef DEBUG
+ if (auto* root = mPresContext->Document()->GetRootElement()) {
+ VerifyFlatTree(*root);
+ }
+#endif
+
DoProcessPendingRestyles(ServoTraversalFlags::Empty);
}
diff --git a/layout/base/crashtests/1409088.html b/layout/base/crashtests/1409088.html
new file mode 100644
index 000000000000..a6fe16469202
--- /dev/null
+++ b/layout/base/crashtests/1409088.html
@@ -0,0 +1,16 @@
+
+
+
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index 209089e4d72a..29f01af1e1bc 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -508,4 +508,5 @@ load 1401739.html
load 1401840.html
load 1402476.html
load 1406562.html
+load 1409088.html
load 1409147.html