Found while fuzzing m-c 20211217-2c242fa34cb6 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html --xvfb --repeat 10

Assertion failure: mChildOpacityState != ChildOpacityState::Applied, at /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:4983

#0 0x7f845153e431 in mozilla::nsDisplayOpacity::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) src/layout/painting/nsDisplayList.cpp:4983:3
#1 0x7f844da55bd7 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1655:41
#2 0x7f844da545a1 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1815:7
#3 0x7f844da53dd8 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1725:9
#4 0x7f845153fb65 in CreateWebRenderCommandsNewClipListOption src/layout/painting/nsDisplayList.cpp:4631:30
#5 0x7f845153fb65 in CreateWebRenderCommands src/layout/painting/nsDisplayList.h:4861:12
#6 0x7f845153fb65 in mozilla::nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) src/layout/painting/nsDisplayList.cpp:5260:22
#7 0x7f844da55bd7 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1655:41
#8 0x7f844da545a1 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1815:7
#9 0x7f844da52ef7 in mozilla::layers::WebRenderCommandBuilder::BuildWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, mozilla::layers::WebRenderScrollData&, WrFiltersHolder&&) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1576:5
#10 0x7f844da664e4 in mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer(mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, WrFiltersHolder&&, mozilla::layers::WebRenderBackgroundData*, double) src/gfx/layers/wr/WebRenderLayerManager.cpp:362:30
#11 0x7f845152e150 in mozilla::nsDisplayList::PaintRoot(mozilla::nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) src/layout/painting/nsDisplayList.cpp:2230:18
#12 0x7f845118daf0 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) src/layout/base/nsLayoutUtils.cpp:3431:9
#13 0x7f84510ffcf1 in mozilla::PresShell::PaintInternal(nsView*, mozilla::PaintInternalFlags) src/layout/base/PresShell.cpp:6446:5
#14 0x7f8450d627ab in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) src/view/nsViewManager.cpp:440:18
#15 0x7f8450d622cb in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) src/view/nsViewManager.cpp:375:22
#16 0x7f8450d6385a in nsViewManager::ProcessPendingUpdates() src/view/nsViewManager.cpp:948:5
#17 0x7f84510bd423 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) src/layout/base/nsRefreshDriver.cpp:2533:11
#18 0x7f84510c45e0 in TickDriver src/layout/base/nsRefreshDriver.cpp:348:13
#19 0x7f84510c45e0 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:326:7
#20 0x7f84510c44e3 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:342:5
#21 0x7f84510c43b0 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:780:5
#22 0x7f84510c3bda in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:703:16
#23 0x7f84510c3433 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() src/layout/base/nsRefreshDriver.cpp:620:7
#24 0x7f84510c3009 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:541:9
#25 0x7f84508660da in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) src/dom/ipc/VsyncMainChild.cpp:68:15
#26 0x7f844d1ea3b2 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:208:54
#27 0x7f844cf9e0dc in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6081:32
#28 0x7f844cc1e52f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2043:25
#29 0x7f844cc1ae61 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:1968:9
#30 0x7f844cc1c2e5 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1827:3
#31 0x7f844cc1cf1d in mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1855:14
#32 0x7f844c18dc0e in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:468:16
#33 0x7f844c1678a6 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:771:26
#34 0x7f844c166568 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:607:15
#35 0x7f844c1667e3 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:391:36
#36 0x7f844c191276 in operator() src/xpcom/threads/TaskController.cpp:124:37
#37 0x7f844c191276 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
#38 0x7f844c17c1e3 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1183:16
#39 0x7f844c18344a in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:467:10
#40 0x7f844cc24346 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:85:21
#41 0x7f844cb43927 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:331:10
#42 0x7f844cb43832 in RunHandler src/ipc/chromium/src/base/message_loop.cc:324:3
#43 0x7f844cb43832 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3
#44 0x7f8450db8a88 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#45 0x7f8452db78d3 in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:864:20
#46 0x7f844cc2523a in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:235:9
#47 0x7f844cb43927 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:331:10
#48 0x7f844cb43832 in RunHandler src/ipc/chromium/src/base/message_loop.cc:324:3
#49 0x7f844cb43832 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3
#50 0x7f8452db6f0b in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:701:34
#51 0x56407e73b029 in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#52 0x56407e73b029 in main src/browser/app/nsBrowserApp.cpp:327:18
#53 0x7f8460d590b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#54 0x56407e7167bc in _start (/home/worker/builds/m-c-20211217212339-fuzzing-debug/firefox-bin+0x157bc)

A Pernosco session is available here: https://pernos.co/debug/IeVBqSe8dKWJ2KCcfOHcFw/index.html

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20211229214859-649a1395ee6c.
Failed to bisect testcase (Testcase reproduces on start build!):

Start: 02d875d4f7d769cd03be3175490377dc600355fe (20201231211652)
End: 2c242fa34cb67de2705237bbf48254c5781b5c9d (20211217212339)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False)

The severity field is not set for this bug.
:miko, could you have a look please?

For more information, please visit auto_nag documentation.

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20211217212339-2c242fa34cb6) but not with tip (mozilla-central 20220128155052-48e8fb0b62c5.)
The bug appears to have been fixed in the following build range:

Start: 9b23d1bb84b2499b94d91c5f588fc93a54e5bdcc (20220124214229)
End: e960e654cbc9f60ce79eb1535fd6ec4e3acc2029 (20220125100058)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=9b23d1bb84b2499b94d91c5f588fc93a54e5bdcc&tochange=e960e654cbc9f60ce79eb1535fd6ec4e3acc2029
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.