Found while fuzzing m-c 20210402-c2f0b7fb408a (--enable-debug --enable-fuzzing)

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Broken accessible tree), at src/accessible/generic/LocalAccessible-inl.h:102

#0 0x7f28ee00f542 in mozilla::a11y::LocalAccessible::InsertAfter(mozilla::a11y::LocalAccessible*, mozilla::a11y::LocalAccessible*) src/accessible/generic/LocalAccessible-inl.h:102:5
#1 0x7f28ee00ed1a in mozilla::a11y::DocAccessible::ProcessContentInserted(mozilla::a11y::LocalAccessible*, nsTArray<nsCOMPtr<nsIContent> > const*) src/accessible/generic/DocAccessible.cpp:2169:21
#2 0x7f28edfd9764 in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) src/accessible/base/NotificationController.cpp:757:16
#3 0x7f28eceaa242 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:2128:12
#4 0x7f28eceb9100 in operator() src/layout/base/nsRefreshDriver.cpp:1460:25
#5 0x7f28eceb9100 in mozilla::detail::RunnableFunction<nsRefreshDriver::EnsureTimerStarted(nsRefreshDriver::EnsureTimerStartedFlags)::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:534:5
#6 0x7f28e85c55e3 in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:470:16
#7 0x7f28e859feb3 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:754:26
#8 0x7f28e859ee04 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:609:15
#9 0x7f28e859ef93 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:393:36
#10 0x7f28e85c9086 in operator() src/xpcom/threads/TaskController.cpp:133:37
#11 0x7f28e85c9086 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:534:5
#12 0x7f28e85b2680 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1159:16
#13 0x7f28e85b932a in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:548:10
#14 0x7f28e8ef2e56 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:87:21
#15 0x7f28e8e5de73 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:335:10
#16 0x7f28e8e5dd8d in RunHandler src/ipc/chromium/src/base/message_loop.cc:328:3
#17 0x7f28e8e5dd8d in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:310:3
#18 0x7f28ecbef088 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#19 0x7f28ee466ea3 in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:906:20
#20 0x7f28e8ef3d3c in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:237:9
#21 0x7f28e8e5de73 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:335:10
#22 0x7f28e8e5dd8d in RunHandler src/ipc/chromium/src/base/message_loop.cc:328:3
#23 0x7f28e8e5dd8d in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:310:3
#24 0x7f28ee466a7f in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:738:34
#25 0x55e2eaa0d0d6 in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#26 0x55e2eaa0d0d6 in main src/browser/app/nsBrowserApp.cpp:309:18

A Pernosco session is available here: https://pernos.co/debug/WN5BqYnF3uZfLv7zh94GjQ/index.html