Found while fuzzing m-c 20220725-00a40cdda673 (--enable-debug --enable-fuzzing).

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: false (Two layers that scroll together have different ancestor transforms), at src/gfx/layers/apz/src/APZCTreeManager.cpp:1343

#0 0x7f299c7a1ff9 in mozilla::layers::APZCTreeManager::PrepareNodeForLayer(mozilla::RecursiveMutexAutoLock const&, mozilla::layers::WebRenderScrollDataWrapper const&, mozilla::layers::FrameMetrics const&, mozilla::layers::LayersId, mozilla::Maybe<mozilla::layers::ZoomConstraints> const&, mozilla::layers::AncestorTransform const&, mozilla::layers::HitTestingTreeNode*, mozilla::layers::HitTestingTreeNode*, mozilla::layers::APZCTreeManager::TreeBuildingState&) src/gfx/layers/apz/src/APZCTreeManager.cpp:1340:13
#1 0x7f299c79552d in operator() src/gfx/layers/apz/src/APZCTreeManager.cpp:488:38
#2 0x7f299c79552d in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) src/gfx/layers/TreeTraversal.h:139:3
#3 0x7f299c796141 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) src/gfx/layers/TreeTraversal.h:143:5
#4 0x7f299c796141 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) src/gfx/layers/TreeTraversal.h:143:5
#5 0x7f299c796141 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) src/gfx/layers/TreeTraversal.h:143:5
#6 0x7f299c796141 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) src/gfx/layers/TreeTraversal.h:143:5
#7 0x7f299c7935b0 in mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int) src/gfx/layers/apz/src/APZCTreeManager.cpp:449:5
#8 0x7f299c80c08f in operator() src/gfx/layers/apz/src/APZUpdater.cpp:199:25
#9 0x7f299c80c08f in mozilla::detail::RunnableFunction<mozilla::layers::APZUpdater::UpdateScrollDataAndTreeState(mozilla::layers::LayersId, mozilla::layers::LayersId, mozilla::wr::Epoch const&, mozilla::layers::WebRenderScrollData&&)::$_28>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
#10 0x7f299c7c6176 in mozilla::layers::APZUpdater::ProcessQueue() src/gfx/layers/apz/src/APZUpdater.cpp:468:23
#11 0x7f299c7c5b7a in mozilla::layers::APZUpdater::CompleteSceneSwap(mozilla::wr::WrWindowId const&, mozilla::wr::WrPipelineInfo const&) src/gfx/layers/apz/src/APZUpdater.cpp:124:12
#12 0x7f299c7c8bd9 in apz_post_scene_swap src/gfx/layers/apz/src/APZUpdater.cpp:536:3
#13 0x7f29a43a43d7 in _$LT$webrender_bindings..bindings..APZCallbacks$u20$as$u20$webrender..renderer..SceneBuilderHooks$GT$::post_scene_swap::h8e1241f3522f813c src/gfx/webrender_bindings/src/bindings.rs:1000:13
#14 0x7f29a46d0fb5 in webrender::scene_builder_thread::SceneBuilderThread::forward_built_transactions::h23f57b6629e54702 src/gfx/wr/webrender/src/scene_builder_thread.rs:722:13
#15 0x7f29a46d0fb5 in webrender::scene_builder_thread::SceneBuilderThread::run::h90b474f778854161 src/gfx/wr/webrender/src/scene_builder_thread.rs:320:21
#16 0x7f29a441352b in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h512ab743a6cd1be6 src/gfx/wr/webrender/src/renderer/mod.rs:1249:13
#17 0x7f29a441352b in std::sys_common::backtrace::__rust_begin_short_backtrace::hec71389d203b25d9 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/sys_common/backtrace.rs:122:18
#18 0x7f29a442fd9e in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::had0a37f2cae5d5dc /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/thread/mod.rs:501:17
#19 0x7f29a442fd9e in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::haa6466fd305619db /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/core/src/panic/unwind_safe.rs:271:9
#20 0x7f29a442fd9e in std::panicking::try::do_call::h6cec0722a3da906d /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/panicking.rs:492:40
#21 0x7f29a442fd9e in std::panicking::try::hf681fd86a8ff0309 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/panicking.rs:456:19
#22 0x7f29a442fd9e in std::panic::catch_unwind::h2dcf72412ab12329 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/panic.rs:137:14
#23 0x7f29a442fd9e in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::he3c2a5cc4f33240a /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/thread/mod.rs:500:30
#24 0x7f29a442fd9e in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h72360ad2896d84cd /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/core/src/ops/function.rs:248:5
#25 0x7f29a5a68562 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::hcbca3baf872b7fe4 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/alloc/src/boxed.rs:1872:9
#26 0x7f29a5a68562 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h18790338ce1743e2 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/alloc/src/boxed.rs:1872:9
#27 0x7f29a5a68562 in std::sys::unix::thread::Thread::new::thread_start::hb1067183bad48893 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/sys/unix/thread.rs:108:17
#28 0x7f29b2203608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
#29 0x7f29b1dca132 in __clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220725213209-8c6f1126927e.
The bug appears to have been introduced in the following build range:

Start: 571fba417e226cd82d1deed500a2eedbdc8e06fc (20220315213924)
End: bf5828257d6e8684439da0f961f07f8d56c94a84 (20220315190155)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=571fba417e226cd82d1deed500a2eedbdc8e06fc&tochange=bf5828257d6e8684439da0f961f07f8d56c94a84

Not seeing an obvious culprit in that regression range - maybe bug 1759514?

(In reply to Ryan VanderMeulen [:RyanVM] from comment #2)

Not seeing an obvious culprit in that regression range - maybe bug 1759514?

That bug would seem reasonable to cause this.

I agree, that sounds like a plausible candidate.

:mikokm, since you are the author of the regressor, bug 1759514, could you take a look?
For more information, please visit auto_nag documentation.

Redirecting needinfo to jrmuizel because Miko no longer works here.
Hi Jeff, here's another bug that might get fixed by turning off old-style retained display list / switching to "retained stacking contexts".

I'm not able to reproduce this locally, but based on the regressing bug I think this is likely to be a case of a retained-DL bug introducing an inconsistency into the display list that would not be there on a full rebuild, as in bug 1734510.

In fact:

• bug 1734510 was (suspected to be) fixed by "Bug 1751742 - Enable stacking context display item reuse in Nightly"
• this bug was regressed by "Bug 1759514 - Disable stacking context display item reuse in Nightly"
• the testcase here does similar things (animate()s some transforms) to the testcase from bug 1734510

So it stands to reason that it's the original RDL bug that caused bug 1734510 that's reappeared here.

Bugmon was unable reproduce this issue.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

A change to the Taskcluster build definitions over the weekend caused Bugmon to fail when reproducing issues. This issue has been corrected. Re-enabling bugmon.