--- a/layout/base/PresShell.cpp
+++ b/layout/base/PresShell.cpp
@@ -8960,17 +8960,21 @@ void PresShell::WillDoReflow() {
 
   mPresContext->FlushFontFeatureValues();
 
   mLastReflowStart = GetPerformanceNowUnclamped();
 }
 
 void PresShell::DidDoReflow(bool aInterruptible) {
   HandlePostedReflowCallbacks(aInterruptible);
-
+  if (mIsDestroying) {
+    return;
+  }
+
+  nsAutoScriptBlocker scriptBlocker;
   AutoAssertNoFlush noReentrantFlush(*this);
   if (nsCOMPtr<nsIDocShell> docShell = mPresContext->GetDocShell()) {
     DOMHighResTimeStamp now = GetPerformanceNowUnclamped();
     docShell->NotifyReflowObservers(aInterruptible, mLastReflowStart, now);
   }
 
   if (!mPresContext->HasPendingInterrupt()) {
     mDocument->ScheduleResizeObserversNotification();

new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/1606492.html
@@ -0,0 +1,21 @@
+<script>
+function go() {
+  var a = document.createElement("e")
+  document.body.appendChild(a)
+  a.addEventListener("DOMSubtreeModified", () => {
+    c.src = ""
+    d.replaceWith(b)
+    f.srcdoc = ""
+  })
+  document.execCommand("selectAll", false)
+  a.setAttribute("s", "")
+}
+</script>
+<div>
+<output id="b"></output>
+<iframe id="c" sandbox="allow-same-origin"></iframe>
+<ul contenteditable="true">
+<li id="d">A</li>
+</ul>
+<iframe id="f"></iframe>
+<audio onloadstart="go()" src="">

--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -553,8 +553,9 @@ load 1576972-1.html
 load 1578844-1.html
 load 1578844-2.html
 load 1579953-1.html
 load 1580576.html
 load empty-mask.html
 load 1586600.html
 load 1599518.html
 load 1599532.html
+pref(layout.accessiblecaret.enabled,true) load 1606492.html