This is happening exactly in https://searchfox.org/mozilla-central/source/gfx/layers/apz/src/WRHitTester.cpp#66

I got this while playing with the devtools debugger in the Browser Toolbox, I'm not sure I can reproduce this reliably.

Also this is in a local debug build of central from a few days ago.

Here is the interesting part of the backtrace:

#3  0x00007fd02efd4235 in common_crap_handler(int, void const*) (signum=11, aFirstFramePC=<optimized out>) at /home/julien/travail/git/mozilla-central/toolkit/xre/nsSigHandlers.cpp:95
#4  0x00007fd02efd431d in ah_crap_handler(int) (signum=0) at /home/julien/travail/git/mozilla-central/toolkit/xre/nsSigHandlers.cpp:103
#5  0x00007fd02efa964a in nsProfileLock::FatalSignalHandler(int, siginfo_t*, void*) (signo=11, info=0x7fff5dd5a330, context=0x7fff5dd5a200) at /home/julien/travail/git/mozilla-central/toolkit/profile/nsProfileLock.cpp:183
#6  0x00007fd02f6ee246 in js::UnixExceptionHandler(int, siginfo_t*, void*) (signum=11, info=0x7fff5dd5a330, context=0x7fff5dd5a200) at /home/julien/travail/git/mozilla-central/js/src/ds/MemoryProtectionExceptionHandler.cpp:282
#7  0x00007fd0301691bb in WasmTrapHandler(int, siginfo_t*, void*) (signum=11, info=0x7fff5dd5a330, context=<optimized out>) at /home/julien/travail/git/mozilla-central/js/src/wasm/WasmSignalHandlers.cpp:745
#8  0x00007fd0356c7140 in <signal handler called> () at /lib/x86_64-linux-gnu/libpthread.so.0
#9  mozilla::layers::WRHitTester::GetAPZCAtPoint(mozilla::gfx::PointTyped<mozilla::ScreenPixel, float> const&, mozilla::RecursiveMutexAutoLock const&) (this=<optimized out>, aHitTestPoint=..., aProofOfTreeLock=<optimized out>)
    at /home/julien/travail/git/mozilla-central/gfx/layers/apz/src/WRHitTester.cpp:66
#10 0x00007fd02a355e90 in mozilla::layers::APZCTreeManager::GetTargetAPZC(mozilla::gfx::PointTyped<mozilla::ScreenPixel, float> const&) (this=0x7fd01ad88600, aPoint=...) at /home/julien/travail/git/mozilla-central/gfx/layers/apz/src/APZCTreeManager.cpp:2798
#11 mozilla::layers::APZCTreeManager::ReceiveInputEvent(mozilla::InputData&) (this=0x7fd01ad88600, aEvent=...) at /home/julien/travail/git/mozilla-central/gfx/layers/apz/src/APZCTreeManager.cpp:1492
#12 0x00007fd02a35bd05 in non-virtual thunk to mozilla::layers::APZCTreeManager::ReceiveInputEvent(mozilla::InputData&) () at /home/julien/travail/git/mozilla-central/gfx/layers/apz/src/AsyncPanZoomController.h:156
#13 0x00007fd02a364d4a in mozilla::layers::APZInputBridge::ReceiveInputEvent(mozilla::WidgetInputEvent&) (this=0x7fd01ad88610, aEvent=...) at /home/julien/travail/git/mozilla-central/gfx/layers/apz/src/APZInputBridge.cpp:133
#14 0x00007fd02d322738 in nsBaseWidget::DispatchInputEvent(mozilla::WidgetInputEvent*) (this=0x7fd0207ee800, aEvent=0x7fff5dd5b5b0) at /home/julien/travail/git/mozilla-central/widget/nsBaseWidget.cpp:1118
#15 0x00007fd02d3b4abf in nsWindow::OnMotionNotifyEvent(_GdkEventMotion*) (this=this@entry=0x7fd0207ee800, aEvent=aEvent@entry=0x7fd014896de0) at /home/julien/travail/git/mozilla-central/widget/gtk/nsWindow.cpp:3952
#16 0x00007fd02d3bbd0d in motion_notify_event_cb(_GtkWidget*, _GdkEventMotion*) (widget=<optimized out>, event=0x7fd014896de0) at /home/julien/travail/git/mozilla-central/widget/gtk/nsWindow.cpp:7370

This is the same assertion seen in {bug 1634763, bug 1690819, bug 1726949}, the code has just moved to a new file recently.