Testcase found while fuzzing mozilla-central rev 1f245c0744d0 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 1f245c0744d0 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip

Assertion failure: GetApzc()->GetParent() == aParent, at /gfx/layers/apz/src/HitTestingTreeNode.cpp:374

    ==505941==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f180b1a76e7 bp 0x7f16e5ff7c20 sp 0x7f16e5ff7c00 T506919)
    ==505941==The signal is caused by a WRITE memory access.
    ==505941==Hint: address points to the zero page.
        #0 0x7f180b1a76e7 in SetApzcParent /gfx/layers/apz/src/HitTestingTreeNode.cpp:374:5
        #1 0x7f180b1a76e7 in mozilla::layers::HitTestingTreeNode::SetPrevSibling(mozilla::layers::HitTestingTreeNode*) /gfx/layers/apz/src/HitTestingTreeNode.cpp:167:17
        #2 0x7f180b131edf in mozilla::layers::APZCTreeManager::PrepareNodeForLayer(mozilla::RecursiveMutexAutoLock const&, mozilla::layers::WebRenderScrollDataWrapper const&, mozilla::layers::FrameMetrics const&, mozilla::layers::LayersId, mozilla::Maybe<mozilla::layers::ZoomConstraints> const&, mozilla::layers::AncestorTransform const&, mozilla::layers::HitTestingTreeNode*, mozilla::layers::HitTestingTreeNode*, mozilla::layers::APZCTreeManager::TreeBuildingState&) /gfx/layers/apz/src/APZCTreeManager.cpp:1317:5
        #3 0x7f180b125dcc in operator() /gfx/layers/apz/src/APZCTreeManager.cpp:490:38
        #4 0x7f180b125dcc in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:139:3
        #5 0x7f180b126cd1 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:143:5
        #6 0x7f180b126cd1 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:143:5
        #7 0x7f180b126cd1 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:143:5
        #8 0x7f180b126cd1 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:143:5
        #9 0x7f180b126cd1 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:143:5
        #10 0x7f180b126cd1 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:143:5
        #11 0x7f180b126cd1 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:143:5
        #12 0x7f180b123e2f in mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int) /gfx/layers/apz/src/APZCTreeManager.cpp:449:5
        #13 0x7f180b1977b2 in operator() /gfx/layers/apz/src/APZUpdater.cpp:196:25
        #14 0x7f180b1977b2 in mozilla::detail::RunnableFunction<mozilla::layers::APZUpdater::UpdateScrollDataAndTreeState(mozilla::layers::LayersId, mozilla::layers::LayersId, mozilla::wr::Epoch const&, mozilla::layers::WebRenderScrollData&&)::$_28>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
        #15 0x7f180b156aff in mozilla::layers::APZUpdater::ProcessQueue() /gfx/layers/apz/src/APZUpdater.cpp:459:23
        #16 0x7f180b15635a in mozilla::layers::APZUpdater::CompleteSceneSwap(mozilla::wr::WrWindowId const&, mozilla::wr::WrPipelineInfo const&) /gfx/layers/apz/src/APZUpdater.cpp:121:12
        #17 0x7f180b159689 in apz_post_scene_swap /gfx/layers/apz/src/APZUpdater.cpp:527:3
        #18 0x7f1812413ae6 in _$LT$webrender_bindings..bindings..APZCallbacks$u20$as$u20$webrender..renderer..SceneBuilderHooks$GT$::post_scene_swap::h99b4a35edfd47fac /gfx/webrender_bindings/src/bindings.rs:1007:13
        #19 0x7f18125e8936 in webrender::scene_builder_thread::SceneBuilderThread::forward_built_transactions::hced81e3e9d38f922 /gfx/wr/webrender/src/scene_builder_thread.rs:719:13
        #20 0x7f18125e8936 in webrender::scene_builder_thread::SceneBuilderThread::run::h45b090d72f48c5aa /gfx/wr/webrender/src/scene_builder_thread.rs:319:21
        #21 0x7f181244fb5c in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h469494766b3f2339 /gfx/wr/webrender/src/renderer/mod.rs:1240:13
        #22 0x7f181244fb5c in std::sys_common::backtrace::__rust_begin_short_backtrace::h63344c73c15b1fb6 /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/std/src/sys_common/backtrace.rs:123:18
        #23 0x7f181246699f in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::hf19578ef60059335 /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/std/src/thread/mod.rs:484:17
        #24 0x7f181246699f in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hdb0819c851d490fe /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/core/src/panic/unwind_safe.rs:271:9
        #25 0x7f181246699f in std::panicking::try::do_call::h63584cd89793bc1f /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/std/src/panicking.rs:406:40
        #26 0x7f181246699f in std::panicking::try::hff613628669c8e52 /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/std/src/panicking.rs:370:19
        #27 0x7f181246699f in std::panic::catch_unwind::h6e8d64f13444060b /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/std/src/panic.rs:133:14
        #28 0x7f181246699f in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::hc25c5a7224576747 /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/std/src/thread/mod.rs:483:30
        #29 0x7f181246699f in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h9c8fe4302e41b559 /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/core/src/ops/function.rs:227:5
        #30 0x7f1813316702 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h3604301cdaaa9dbf /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/alloc/src/boxed.rs:1694:9
        #31 0x7f1813316702 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h4cf736d2de892eff /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/alloc/src/boxed.rs:1694:9
        #32 0x7f1813316702 in std::sys::unix::thread::Thread::new::thread_start::h71a82d4ee5b02c9b /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/std/src/sys/unix/thread.rs:106:17
        #33 0x7f1820acf608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
        #34 0x7f1820697292 in __clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /gfx/layers/apz/src/HitTestingTreeNode.cpp:374:5 in SetApzcParent
    ==505941==ABORTING

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220216214005-d0676cb0864b.
The bug appears to have been introduced in the following build range:

Start: 846edaaa86a91c3bd761a5557bfc729cd89a4c25 (20210917212414)
End: 0cf96895f20cc52cfc3dca89f7b3f023028e7796 (20210917223817)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=846edaaa86a91c3bd761a5557bfc729cd89a4c25&tochange=0cf96895f20cc52cfc3dca89f7b3f023028e7796

Probably bug 1729581.

Set release status flags based on info from the regressing bug 1729581

The severity field is not set for this bug.
:botond, could you have a look please?

For more information, please visit auto_nag documentation.

Attaching just the html file for convenience. The assertion reproduces with layout.css.backdrop-filter.enabled=true.

This looks to be fixed by bug 1749190.

https://hg.mozilla.org/mozilla-central/rev/4ec4b88c2c50

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220316041325-a2742e46efb5.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

The patch landed in nightly and beta is affected.
:botond, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.

We'll let the fix for this ride the trains.