Found with m-c 20230814-a5bcd3edffd7 (--enable-debug)

This was found by visiting a live website with a debug build.

STR:

• Launch browser and visit: www.tiktok.com

I can likely get a Pernosco session if needed.

Assertion failure: sInServoTraversal || NS_IsMainThread(), at /builds/worker/workspace/obj-build/dist/include/mozilla/ServoUtils.h:33

#0 0x7f572e78ec37 in IsInServoTraversal /builds/worker/workspace/obj-build/dist/include/mozilla/ServoUtils.h:33:3
#1 0x7f572e78ec37 in IsInServoTraversal /builds/worker/workspace/obj-build/dist/include/mozilla/ServoStyleSet.h:117:45
#2 0x7f572e78ec37 in pref_Lookup(char const*, bool) /builds/worker/checkouts/gecko/modules/libpref/Preferences.cpp:1789:3
#3 0x7f572e82bbab in mozilla::IsPreferenceSanitized(char const*) /builds/worker/checkouts/gecko/modules/libpref/Preferences.cpp:6198:33
#4 0x7f5731bd78e8 in webgl_override_unmasked_renderer /builds/worker/workspace/obj-build/dist/include/mozilla/StaticPrefList_webgl.h:332:1
#5 0x7f5731bd78e8 in mozilla::ClientWebGLContext::GetParameter(JSContext*, unsigned int, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, bool)::$_2::operator()[abi:cxx11]() const /builds/worker/checkouts/gecko/dom/canvas/ClientWebGLContext.cpp:2269:29
#6 0x7f5731bd5f20 in mozilla::ClientWebGLContext::GetParameter(JSContext*, unsigned int, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, bool) /builds/worker/checkouts/gecko/dom/canvas/ClientWebGLContext.cpp:2299:17
#7 0x7f57313acdd7 in mozilla::dom::WebGLRenderingContext_Binding::getParameter(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WebGLRenderingContextBinding.cpp:18473:24
#8 0x7f5731a95048 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3327:13

Reproduces for me.

Fuzzers did find a test case for this.

Verified bug as reproducible on mozilla-central 20230816215210-1c8dec8815d5.
The bug appears to have been introduced in the following build range:

Start: 7ca85c53a53df7d84d24662c11934a5022ad5fc7 (20230206191433)
End: f79377e1676571e1f9d5a819362fb7020c38c1be (20230206211401)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=7ca85c53a53df7d84d24662c11934a5022ad5fc7&tochange=f79377e1676571e1f9d5a819362fb7020c38c1be

Set release status flags based on info from the regressing bug 1799258

:jgilbert, since you are the author of the regressor, bug 1799258, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.