Debian Testing, KDE, X11, Macbook Pro A1502, Intel Iris 6100 (Broadwell GT3)
Screenshot:
mozregression --launch 2019-07-11 --pref gfx.webrender.all:true -a https://mozilla.invisionapp.com/share/38S2U6FPFKD#/screens/360900829

Doesn't happen without WebRender.
layout.css.scroll-anchoring.enabled;false doesn't help.
On a quick look I didn't see this problem on Win10/GTX1060.

Went back in steps of 2 months. Also broken with 2018-12-20.
But it crashed days before that (main process):
mozregression --launch 2018-12-05 -B debug --pref gfx.webrender.all:true -a https://mozilla.invisionapp.com/share/38S2U6FPFKD#/screens/360900829

1:01.94 INFO: Hit MOZ_CRASH(assertion failed: upload_size <= data.len() * mem::size_of::<T>()) at gfx/wr/webrender/src/device/gl.rs:2899

When the crash disappeared (good=crash, bad=visually corrupt as on the screenshot):
mozregression --good 2018-12-05 --bad 2018-12-20 --pref gfx.webrender.all:true browser.startup.homepage:'https://mozilla.invisionapp.com/share/38S2U6FPFKD#/screens/360900829'

12:42.96 INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=c4eb9f94bc4c52e0489f8e5b7f7fc931ef013816&tochange=d65d6d242070557db836baa1fcc3d26529590efa

d65d6d242070557db836baa1fcc3d26529590efa WR Updater Bot — Bug 1514735 - Update webrender to commit 4de718f9ea3435c099cabafc02e8b51da539bc62 (WR PR #3428). r=kats

= Assert against GL errors and check framebuffer completeness #3428
https://github.com/servo/webrender/pull/3428

Ran last good/first bad manually: This stopped the crash, but uncovered the visual corruption!

When the crashing began (good=everything seems fine, bad=crash):
mozregression --good 2018-11-15 --bad 2018-12-05 --pref gfx.webrender.all:true browser.startup.homepage:'https://mozilla.invisionapp.com/share/38S2U6FPFKD#/screens/360900829'

9:23.63 INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=3b50a5b394b9467ba99fa0e956b53c49b66f3238&tochange=df30b0f614c904678b72d66616a65b989f9a87e9

df30b0f614c904678b72d66616a65b989f9a87e9 Nicolas Silva — Bug 1494403 - Separate the Blob related apis. r=jrmuizel
b75eb61d2048a0a0dabeb08ad390a0286358b55e WR Updater Bot — Bug 1509495 - Update reftest annotations for changes in WR PR #3277. r=kats
6d9d2397f1153e5e9062f342015f28ca3576bfee WR Updater Bot — Bug 1509495 - Update webrender to commit af2b372624db589115511b4705849a33e6acd35d (WR PR #3277). r=kats

CC'ing assignees: Nical introduced a memory-related crash, bholley replaced crash with visual corruption.

Like in bug 1562462 comment 14 my Macbook was hot and fans were blowing. I would assume that this seems to be a condition where visual corruption can appear. It would be interesting if I could still reproduce it with a cold Macbook: I'll turn it off for some time and try again.

Macbook temperature is rather not relevant.
This does neither seem to be a duplicate of bug 1518796 because it's still reproducible with MOZ_GTK_TITLEBAR_DECORATION=none.

Bug 1565566 got my attention, so I tested a bit.

Apparently this was fixed on autoland:

https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=5f93b343bff5fbf3895c83e86a3aa1f7268b1a0b&tochange=e958d9b8d9e4519426ace0a228832e6504e38f42

e958d9b8d9e4519426ace0a228832e6504e38f42 Nicolas Silva — Bug 1559688 - Clip tile dirty rects to the tile's total rect. r=aosmond

Because the dirty rect is translated to tile-local coordinates we sometimes get a rect that extends to negative parts of the plane which confuses the texture upload code. The latter tries to crop the upload rect back to something sensible but that doesn't match what we want here.
This patch fixes the bug.

Like the former crash in comment 0, bug 1559688 was also introduced by bug 1509495.
Both ranges of comment 0 are mentioned in bug 1559688, too.
Thanks for fixing! :)