==38597==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000030 (pc 0x7f97b8d2c19b bp 0x7ffc255bc630 sp 0x7ffc255bc540 T0)
==38597==The signal is caused by a READ memory access.
==38597==Hint: address points to the zero page.
    #0 0x7f97b8d2c19a in get src/obj-firefox/dist/include/nsCOMPtr.h:823:48
    #1 0x7f97b8d2c19a in operator nsIContent * src/obj-firefox/dist/include/nsCOMPtr.h:831
    #2 0x7f97b8d2c19a in GetContent src/layout/generic/nsIFrame.h:724
    #3 0x7f97b8d2c19a in mozilla::SVGGeometryFrame::GetCanvasTM() src/layout/svg/SVGGeometryFrame.cpp:634
    #4 0x7f97b8db9a81 in nsSVGMarkerFrame::GetCanvasTM() src/layout/svg/nsSVGMarkerFrame.cpp:74:38
    #5 0x7f97b8dd1db4 in nsSVGMarkerAnonChildFrame::GetCanvasTM() src/layout/svg/nsSVGMarkerFrame.h:154:57
    #6 0x7f97b8d9f837 in nsSVGForeignObjectFrame::GetCanvasTM() src/layout/svg/nsSVGForeignObjectFrame.cpp:468:62
    #7 0x7f97b8dd82da in nsSVGUtils::GetCanvasTM(nsIFrame*) src/layout/svg/nsSVGUtils.cpp:344:59
    #8 0x7f97b8d7cbbf in nsFilterInstance::GetPostFilterBounds(nsIFrame*, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, double> const*, nsRect const*) src/layout/svg/nsFilterInstance.cpp:424:18
    #9 0x7f97b8dd5853 in nsSVGUtils::GetPostFilterVisualOverflowRect(nsIFrame*, nsRect const&) src/layout/svg/nsSVGUtils.cpp:145:10
    #10 0x7f97b890be4d in ComputeEffectsRect src/layout/generic/nsFrame.cpp:7026:11
    #11 0x7f97b890be4d in nsIFrame::FinishAndStoreOverflow(nsOverflowAreas&, nsSize, nsSize*, nsStyleDisplay const*) src/layout/generic/nsFrame.cpp:9075
    #12 0x7f97b890881e in nsIFrame::UpdateOverflow() src/layout/generic/nsFrame.cpp:7189:7
    #13 0x7f97b852fdf9 in mozilla::OverflowChangedTracker::Flush() src/layout/base/OverflowChangedTracker.h:107:34
    #14 0x7f97b854c3df in FlushOverflowChangedTracker src/obj-firefox/dist/include/mozilla/RestyleManager.h:219:64
    #15 0x7f97b854c3df in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) src/layout/base/RestyleManager.cpp:3130
    #16 0x7f97b84e37e9 in ProcessPendingRestyles src/layout/base/RestyleManager.cpp:3168:3
    #17 0x7f97b84e37e9 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) src/layout/base/PresShell.cpp:4127
    #18 0x7f97b844dc45 in FlushPendingNotifications src/layout/base/nsIPresShell.h:581:5
    #19 0x7f97b844dc45 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1879
    #20 0x7f97b8462559 in TickDriver src/layout/base/nsRefreshDriver.cpp:342:13
    #21 0x7f97b8462559 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:319
    #22 0x7f97b8461e48 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:336:5
    #23 0x7f97b846608f in RunRefreshDrivers src/layout/base/nsRefreshDriver.cpp:772:5
    #24 0x7f97b846608f in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:692
    #25 0x7f97b846524a in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:592:9
    #26 0x7f97b8f4ebc5 in mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:65:16
    #27 0x7f97af69993b in mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:168:54
    #28 0x7f97af262a77 in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:2808:28
    #29 0x7f97aea8cb59 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2150:21
    #30 0x7f97aea8895a in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2077:9
    #31 0x7f97aea8ab61 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1936:3
    #32 0x7f97aea8b927 in mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1967:13
    #33 0x7f97ad818fb6 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1162:14
    #34 0x7f97ad820e5d in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:475:10
    #35 0x7f97aea95f5f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:88:21
    #36 0x7f97ae97e23e in RunInternal src/ipc/chromium/src/base/message_loop.cc:315:10
    #37 0x7f97ae97e23e in RunHandler src/ipc/chromium/src/base/message_loop.cc:308
    #38 0x7f97ae97e23e in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290
    #39 0x7f97b7d6c913 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
    #40 0x7f97bc90babe in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:911:20
    #41 0x7f97ae97e23e in RunInternal src/ipc/chromium/src/base/message_loop.cc:315:10
    #42 0x7f97ae97e23e in RunHandler src/ipc/chromium/src/base/message_loop.cc:308
    #43 0x7f97ae97e23e in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290
    #44 0x7f97bc90ac13 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:749:34
    #45 0x55ed7e8b8874 in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:49:28
    #46 0x55ed7e8b8874 in main src/browser/app/nsBrowserApp.cpp:265

FWIW, here's the local testcase that I used to test whether we were relying on this change hint or not.

It dynamically adds/removes a text-decoration on the non-display <marker> element, which then shows up on its text & tspan descendant. The invalidation seems to work correctly (and paint flashing shows that the invalidated region gets larger when the decoration is added), so I think we're not leaning on this change hint to take care of that in this case.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=c4c6d72adf6175a223edb9ddbce4f67cf972b57b

https://hg.mozilla.org/mozilla-central/rev/e9672ac059b4