Reduced with m-c:
BuildID=20190528101320
SourceStamp=5cc220ddf028de011a922042ee9ba691b94d055d

Assertion failure: !AnyContentAncestorModified(item->FrameForInvalidation()), at src/layout/painting/RetainedDisplayListBuilder.cpp:744

#0 VerifyNotModified(nsDisplayList*) src/layout/painting/RetainedDisplayListBuilder.cpp:746:15
#1 VerifyNotModified(nsDisplayList*) src/layout/painting/RetainedDisplayListBuilder.cpp:747:7
#2 RetainedDisplayListBuilder::MergeDisplayLists(nsDisplayList*, RetainedDisplayList*, RetainedDisplayList*, mozilla::Maybe<mozilla::ActiveScrolledRoot const*>&, nsDisplayItem*) src/layout/painting/RetainedDisplayListBuilder.cpp:778:5
#3 MergeState::MergeChildLists(nsDisplayItem*, nsDisplayItem*, nsDisplayItem*) src/layout/painting/RetainedDisplayListBuilder.cpp:480:37
#4 MergeState::ProcessItemFromNewList(nsDisplayItem*, mozilla::Maybe<Index<MergedListUnits> > const&) src/layout/painting/RetainedDisplayListBuilder.cpp:452:9
#5 RetainedDisplayListBuilder::MergeDisplayLists(nsDisplayList*, RetainedDisplayList*, RetainedDisplayList*, mozilla::Maybe<mozilla::ActiveScrolledRoot const*>&, nsDisplayItem*) src/layout/painting/RetainedDisplayListBuilder.cpp:792:31
#6 RetainedDisplayListBuilder::AttemptPartialUpdate(unsigned int, mozilla::DisplayListChecker*) src/layout/painting/RetainedDisplayListBuilder.cpp:1464:7
#7 nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) src/layout/base/nsLayoutUtils.cpp:3812:40
#8 mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags) src/layout/base/PresShell.cpp:6154:5
#9 nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) src/view/nsViewManager.cpp:461:18
#10 nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) src/view/nsViewManager.cpp:396:22
#11 nsViewManager::ProcessPendingUpdates() src/view/nsViewManager.cpp:1019:5
#12 nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:2097:11
#13 mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:326:7
#14 mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:343:5
#15 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:709:16
#16 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:604:9
#17 mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:65:16
#18 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:187:54
#19 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:4717:32
#20 mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2158:25
#21 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2082:9
#22 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1939:3
#23 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1970:13
#24 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1176:14
#25 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
#26 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:88:21
#27 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#28 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#29 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#30 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:911:20
#31 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
#32 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#33 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#34 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:749:34
#35 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#36 main src/browser/app/nsBrowserApp.cpp:263:18

The issue here is that we reparent a frame, and that doesn't mark the old parent as invalid.

The assumption is that because the old parent isn't invalid, and has no invalid children currently, then any display items descendants of its display items must also not be invalid.

This doesn't work, since it has descendant display items belonging to the old child, which are invalid.

Checking for invalid items, at the same time as we check for invalid frames (PreProcessDisplayList) will catch this.

Depends on D33880

Backed out 2 changesets (Bug 1547802, Bug 1555819) mochitest and marionette failures CLOSED TREE

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&selectedJob=250544437&revision=10ba834418464da93470c019bdc77aba6c7dc6d8

Failure logs:
mochitest: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=250546058&repo=autoland&lineNumber=4924
marionette: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=250546656&repo=autoland&lineNumber=2624

Backout: https://hg.mozilla.org/integration/autoland/rev/ddfb232dc8762ddb1c18bb0861dd7245268e8774

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&fromchange=aea91be6ce82cdcdcec53744b46ae5e4660b234c&tochange=834892bbe2f31f049d17cc6c65336e23b3bbc622

Failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=251081638&repo=autoland&lineNumber=24459

Backout link: https://hg.mozilla.org/integration/autoland/rev/834892bbe2f31f049d17cc6c65336e23b3bbc622

[task 2019-06-11T03:52:47.104Z] 03:52:47 INFO - In file included from /builds/worker/workspace/build/src/obj-firefox/layout/painting/Unified_cpp_layout_painting0.cpp:128:
[task 2019-06-11T03:52:47.104Z] 03:52:47 ERROR - /builds/worker/workspace/build/src/layout/painting/nsDisplayList.cpp:2381:8: error: use of undeclared identifier 'mModifiedFramesDuringBuilding'
[task 2019-06-11T03:52:47.104Z] 03:52:47 INFO - n += mModifiedFramesDuringBuilding.ShallowSizeOfExcludingThis(mallocSizeOf);
[task 2019-06-11T03:52:47.104Z] 03:52:47 INFO - ^
[task 2019-06-11T03:52:47.104Z] 03:52:47 INFO - 1 error generated.
[task 2019-06-11T03:52:47.105Z] 03:52:47 INFO - /builds/worker/workspace/build/src/config/rules.mk:810: recipe for target 'Unified_cpp_layout_painting0.o' failed
[task 2019-06-11T03:52:47.105Z] 03:52:47 ERROR - make[4]: *** [Unified_cpp_layout_painting0.o] Error 1
[task 2019-06-11T03:52:47.105Z] 03:52:47 INFO - make[4]: Leaving directory '/builds/worker/workspace/build/src/obj-firefox/layout/painting'
[task 2019-06-11T03:52:47.105Z] 03:52:47 INFO - /builds/worker/workspace/build/src/config/recurse.mk:74: recipe for target 'layout/painting/target' failed
[task 2019-06-11T03:52:47.105Z] 03:52:47 ERROR - make[3]: *** [layout/painting/target] Error 2

https://hg.mozilla.org/mozilla-central/rev/01b51b19aae7

Matt, is there a user impact here which justifies backport consideration or can this ride the trains?

There potentially is, but there haven't been any reported cases yet that I know of (except for this fuzzer one), so I'd prefer to just let it ride the trains.