Reduced with m-c:
BuildID=20190320112939
SourceStamp=25398e555020fef80c7b2a06a0d4c667e861cd6f

Assertion failure: !entry.mManager->IsDestroyed(), at src/gfx/layers/ipc/SharedSurfacesChild.cpp:519

#0 mozilla::layers::SharedSurfacesAnimation::Destroy() src/gfx/layers/ipc/SharedSurfacesChild.cpp:519:5
#1 mozilla::layers::ImageContainer::~ImageContainer() src/gfx/layers/ImageContainer.cpp:223:23
#2 mozilla::layers::ImageContainer::Release() src/obj-firefox/dist/include/ImageContainer.h:372:3
#3 mozilla::layers::WebRenderImageData::~WebRenderImageData() src/gfx/layers/wr/WebRenderUserData.cpp:109:1
#4 mozilla::layers::WebRenderImageData::~WebRenderImageData() src/gfx/layers/wr/WebRenderUserData.cpp:103:43
#5 mozilla::layers::WebRenderUserData::Release() src/obj-firefox/dist/include/mozilla/layers/WebRenderUserData.h:64:3
#6 void PLDHashTable::EntryStore::ForEachSlot<PLDHashTable::~PLDHashTable()::$_0>(char*, unsigned int, unsigned int, PLDHashTable::~PLDHashTable()::$_0&&) src/obj-firefox/dist/include/PLDHashTable.h:359:9
#7 PLDHashTable::~PLDHashTable() src/xpcom/ds/PLDHashTable.cpp:302:15
#8 nsIFrame::RemoveDisplayItemDataForDeletion() src/layout/generic/nsFrame.cpp:1005:5
#9 nsIPresShell::NotifyDestroyingFrame(nsIFrame*) src/layout/base/PresShell.cpp:2083:11
#10 nsFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsFrame.cpp:818:10
#11 nsContainerFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsContainerFrame.cpp:284:22
#12 nsImageFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsImageFrame.cpp:271:27
#13 nsFrameList::DestroyFramesFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsFrameList.cpp:51:12
#14 nsContainerFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsContainerFrame.cpp:211:11
#15 nsFrameList::DestroyFramesFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsFrameList.cpp:51:12
#16 nsContainerFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsContainerFrame.cpp:211:11
#17 nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsLineBox.cpp:371:14
#18 nsBlockFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsBlockFrame.cpp:326:3
#19 nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsLineBox.cpp:371:14
#20 nsBlockFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsBlockFrame.cpp:326:3
#21 nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsLineBox.cpp:371:14
#22 nsBlockFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsBlockFrame.cpp:326:3
#23 nsFrameList::DestroyFramesFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsFrameList.cpp:51:12
#24 nsContainerFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsContainerFrame.cpp:211:11
#25 nsCanvasFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsCanvasFrame.cpp:218:21
#26 nsFrameList::DestroyFramesFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsFrameList.cpp:51:12
#27 nsContainerFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsContainerFrame.cpp:211:11
#28 nsFrameList::DestroyFramesFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsFrameList.cpp:51:12
#29 nsContainerFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) src/layout/generic/nsContainerFrame.cpp:211:11
#30 nsIFrame::Destroy() src/layout/generic/nsIFrame.h:656:5
#31 nsFrameManager::Destroy() src/layout/base/nsFrameManager.cpp:53:17
#32 mozilla::PresShell::Destroy() src/layout/base/PresShell.cpp:1348:22
#33 nsDocumentViewer::DestroyPresShell() src/layout/base/nsDocumentViewer.cpp:4232:15
#34 nsDocumentViewer::Destroy() src/layout/base/nsDocumentViewer.cpp:1803:5
#35 nsDocShell::Destroy() src/docshell/base/nsDocShell.cpp:4968:21
#36 nsWebBrowser::SetDocShell(nsIDocShell*) src/toolkit/components/browser/nsWebBrowser.cpp:1268:23
#37 nsWebBrowser::InternalDestroy() src/toolkit/components/browser/nsWebBrowser.cpp:190:3
#38 nsWebBrowser::Destroy() src/toolkit/components/browser/nsWebBrowser.cpp:939:3
#39 non-virtual thunk to nsWebBrowser::Destroy() src/toolkit/components/browser/nsWebBrowser.cpp
#40 mozilla::dom::TabChild::DestroyWindow() src/dom/ipc/TabChild.cpp:947:31
#41 mozilla::dom::TabChild::RecvDestroy() src/dom/ipc/TabChild.cpp:2299:3
#42 mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBrowserChild.cpp:4835:20
#43 mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PContentChild.cpp:5462:28
#44 mozilla::dom::ContentChild::OnMessageReceived(IPC::Message const&) src/dom/ipc/ContentChild.cpp:3693:25
#45 mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2151:21
#46 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2078:9
#47 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1937:3
#48 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1968:13
#49 mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:295:32
#50 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1180:14
#51 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:482:10
#52 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:88:21
#53 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#54 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#55 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#56 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:933:20
#57 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
#58 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#59 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#60 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:771:34
#61 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#62 main src/browser/app/nsBrowserApp.cpp:263:18

Andrew said he'd look into this. (FWIW this is happening on browser-chrome mochitests as well on Linux and Windows with WR enabled).

We have an early return here:

https://searchfox.org/mozilla-central/rev/4606c7974a68cab416c038acaedcae49eed93822/gfx/layers/ipc/SharedSurfacesChild.cpp#533

Which is called in SharedSurfacesAnimation::UpdateKey when we first encounter the manager. First it is for the first frame, it isn't recyclable for complicated reasons, so it bails early and doesn't call SharedSurfacesAnimation::RegisterAsyncAnimation. If that isn't called, then when the manager is destroyed, it doesn't call SharedSurfacesAnimation::Invalidate to remove itself from the list. In turn that means it will remain there when we call SharedSurfacesAnimation::Destroy. Everything is working, but the assert is a bit too aggressive. I tried to be optimal and avoid checking for destroyed managers like we do in the non-animated case because we have that callback....

Will write patch to fix this.

By default, recycling frames for animated images is enabled. However the
first frame is never recycled because we may need the first frame
immediately if the animation is reset. If only the first frame of an
animation is displayed before shutting down a tab, then it will not
correctly register with the layer state manager prior to its
destruction. This trips an assert incorrectly.

Now we just always register with the layer state manager if recycling is
enabled, and never if recycling is disabled. This allows us to remove
from state information at the cost of requiring a restart to toggle to
recycling pref (which is almost never done now that the feature is
stable.)

https://hg.mozilla.org/mozilla-central/rev/29c76bc4b590

Is this worth uplifting to 68? I guess not if it's just crashing in debug?

I don't think we need to uplift this unless it is causing issues in automation.