Found while fuzzing m-c 20210318-0438c8585f5f (--enable-debug --enable-fuzzing)

Assertion failure: ancestor->IsPrimaryFrame(), at src/layout/generic/nsIFrame.cpp:2874

#0 0x7f3f3e4ca507 in FrameParticipatesIn3DContext src/layout/generic/nsIFrame.cpp:2874:3
#1 0x7f3f3e4ca507 in ItemParticipatesIn3DContext src/layout/generic/nsIFrame.cpp:2908:10
#2 0x7f3f3e4ca507 in nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsDisplayList*, bool*) src/layout/generic/nsIFrame.cpp:3611:11
#3 0x7f3f3e436f83 in nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) src/layout/generic/nsIFrame.cpp:4206:12
#4 0x7f3f3e5dc3ac in DisplayRows src/layout/tables/nsTableRowGroupFrame.cpp:224:8
#5 0x7f3f3e5dc3ac in nsTableRowGroupFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&) src/layout/tables/nsTableRowGroupFrame.cpp:257:3
#6 0x7f3f3e4c81a3 in nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsDisplayList*, bool*) src/layout/generic/nsIFrame.cpp:3410:5
#7 0x7f3f3e436f83 in nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) src/layout/generic/nsIFrame.cpp:4206:12
#8 0x7f3f3e5c0a28 in nsTableFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&) src/layout/tables/nsTableFrame.cpp:1329:5
#9 0x7f3f3e4370ec in nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) src/layout/generic/nsIFrame.cpp:4239:14
#10 0x7f3f3e5e5628 in BuildDisplayListForInnerTable src/layout/tables/nsTableWrapperFrame.cpp:205:5
#11 0x7f3f3e5e5628 in nsTableWrapperFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&) src/layout/tables/nsTableWrapperFrame.cpp:172:5
#12 0x7f3f3e4370ec in nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) src/layout/generic/nsIFrame.cpp:4239:14
#13 0x7f3f3e41e3fd in DisplayLine(nsDisplayListBuilder*, nsLineList_iterator&, bool, nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) src/layout/generic/nsBlockFrame.cpp:6891:13
#14 0x7f3f3e41cef4 in nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&) src/layout/generic/nsBlockFrame.cpp:7049:9
#15 0x7f3f3e4c81a3 in nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsDisplayList*, bool*) src/layout/generic/nsIFrame.cpp:3410:5
#16 0x7f3f3e436f83 in nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) src/layout/generic/nsIFrame.cpp:4206:12
#17 0x7f3f3e41e3fd in DisplayLine(nsDisplayListBuilder*, nsLineList_iterator&, bool, nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) src/layout/generic/nsBlockFrame.cpp:6891:13
#18 0x7f3f3e41cef4 in nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&) src/layout/generic/nsBlockFrame.cpp:7049:9
#19 0x7f3f3e4c81a3 in nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsDisplayList*, bool*) src/layout/generic/nsIFrame.cpp:3410:5
#20 0x7f3f3e436f83 in nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) src/layout/generic/nsIFrame.cpp:4206:12
#21 0x7f3f3e427e18 in nsCanvasFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&) src/layout/generic/nsCanvasFrame.cpp:640:5
#22 0x7f3f3e4370ec in nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) src/layout/generic/nsIFrame.cpp:4239:14
#23 0x7f3f3e3f7e6d in mozilla::ViewportFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&) src/layout/generic/ViewportFrame.cpp:66:3
#24 0x7f3f3e4370ec in nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) src/layout/generic/nsIFrame.cpp:4239:14
#25 0x7f3f3e52e9e8 in nsPageFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&) src/layout/generic/nsPageFrame.cpp:680:5
#26 0x7f3f3e4c81a3 in nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsDisplayList*, bool*) src/layout/generic/nsIFrame.cpp:3410:5
#27 0x7f3f3e3d9fd5 in mozilla::PrintedSheetFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&) src/layout/generic/PrintedSheetFrame.cpp:112:16
#28 0x7f3f3e4c81a3 in nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsDisplayList*, bool*) src/layout/generic/nsIFrame.cpp:3410:5
#29 0x7f3f3e3a09d4 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) src/layout/base/nsLayoutUtils.cpp:3393:17
#30 0x7f3f3e532a35 in nsPageSequenceFrame::PrintNextSheet() src/layout/generic/nsPageSequenceFrame.cpp:674:3
#31 0x7f3f3e789af9 in nsPrintJob::PrintSheet(nsPrintObject*, bool&) src/layout/printing/nsPrintJob.cpp:2351:31
#32 0x7f3f3e789786 in nsPagePrintTimer::Run() src/layout/printing/nsPagePrintTimer.cpp:74:43
#33 0x7f3f39951c32 in mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:146:20
#34 0x7f3f3995804f in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:472:16
#35 0x7f3f399565d0 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:760:26
#36 0x7f3f39955534 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:611:15
#37 0x7f3f399556e7 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:395:36
#38 0x7f3f3995bcf9 in operator() src/xpcom/threads/TaskController.cpp:136:37
#39 0x7f3f3995bcf9 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_4>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:534:5
#40 0x7f3f3996d177 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1158:16
#41 0x7f3f399736ea in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:548:10
#42 0x7f3f3b499310 in bool mozilla::SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, nsGlobalWindowOuter::Print(nsIPrintSettings*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::IsForWindowDotPrint, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&, mozilla::ErrorResult&)::$_4>(nsGlobalWindowOuter::Print(nsIPrintSettings*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::IsForWindowDotPrint, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&, mozilla::ErrorResult&)::$_4&&, nsIThread*) /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:93:25
#43 0x7f3f3b49742b in nsGlobalWindowOuter::Print(nsIPrintSettings*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::IsForWindowDotPrint, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&, mozilla::ErrorResult&) src/dom/base/nsGlobalWindowOuter.cpp:5380:5
#44 0x7f3f3b4966dc in nsGlobalWindowOuter::PrintOuter(mozilla::ErrorResult&) src/dom/base/nsGlobalWindowOuter.cpp:5203:3
#45 0x7f3f3c3816d3 in mozilla::dom::Window_Binding::print(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WindowBinding.cpp:3116:24
#46 0x7f3f3c92fc6c in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3238:13
#47 0x7f3f3f9b6620 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:435:13
#48 0x7f3f3f9b5d8c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:520:12
#49 0x7f3f3f9b7589 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:580:10
#50 0x7f3f3f9ac0df in CallFromStack src/js/src/vm/Interpreter.cpp:584:10
#51 0x7f3f3f9ac0df in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3244:16
#52 0x7f3f3f9a35a1 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:405:13
#53 0x7f3f3f9b5da9 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:552:13
#54 0x7f3f3f9b7589 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:580:10
#55 0x7f3f3f9b77af in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:597:8
#56 0x7f3f3ff2c5fb in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2856:10
#57 0x7f3f3c21bb3f in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::IdleDeadline&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/WindowBinding.cpp:874:8
#58 0x7f3f3b4e3e6a in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::IdleDeadline&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:782:12
#59 0x7f3f3b5d5669 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:795:12
#60 0x7f3f3b5d5669 in mozilla::dom::IdleRequest::IdleRun(nsPIDOMWindowInner*, double, bool) src/dom/base/IdleRequest.cpp:61:13
#61 0x7f3f3b456c33 in nsGlobalWindowInner::RunIdleRequest(mozilla::dom::IdleRequest*, double, bool) src/dom/base/nsGlobalWindowInner.cpp:745:12
#62 0x7f3f3b456005 in nsGlobalWindowInner::ExecuteIdleRequest(mozilla::TimeStamp) src/dom/base/nsGlobalWindowInner.cpp:773:3
#63 0x7f3f3b455e34 in IdleRequestExecutor::Run() src/dom/base/nsGlobalWindowInner.cpp:614:13
#64 0x7f3f3995804f in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:472:16
#65 0x7f3f399565d0 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:760:26
#66 0x7f3f399555e6 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:634:15
#67 0x7f3f399556e7 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:395:36
#68 0x7f3f3995bc86 in operator() src/xpcom/threads/TaskController.cpp:133:37
#69 0x7f3f3995bc86 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:534:5
#70 0x7f3f3996d177 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1158:16
#71 0x7f3f399736ea in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:548:10
#72 0x7f3f3a29d346 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:87:21
#73 0x7f3f3a2081a3 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:335:10
#74 0x7f3f3a2080bd in RunHandler src/ipc/chromium/src/base/message_loop.cc:328:3
#75 0x7f3f3a2080bd in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:310:3
#76 0x7f3f3e021878 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#77 0x7f3f3f881303 in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:901:20
#78 0x7f3f3a29e22c in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:237:9
#79 0x7f3f3a2081a3 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:335:10
#80 0x7f3f3a2080bd in RunHandler src/ipc/chromium/src/base/message_loop.cc:328:3
#81 0x7f3f3a2080bd in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:310:3
#82 0x7f3f3f880ed8 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:733:34
#83 0x5591f9706fb6 in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#84 0x5591f9706fb6 in main src/browser/app/nsBrowserApp.cpp:309:18
#85 0x7f3f505e40b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#86 0x5591f96e4d5c in _start (/home/worker/builds/m-c-20210318160736-fuzzing-debug/firefox-bin+0x14d5c)

A Pernosco session is available here: https://pernos.co/debug/bRAN4weSTqRIxhAabTw16w/index.html

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210319215733-e8ee87ef82c3.
The bug appears to have been introduced in the following build range:

Start: 0edbbe70c420684f0ae9c70da93f8b68db3cba60 (20200610124712)
End: 796d8685f8ce4b049e5c7a2d6150cbcb102c6a69 (20200610143744)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=0edbbe70c420684f0ae9c70da93f8b68db3cba60&tochange=796d8685f8ce4b049e5c7a2d6150cbcb102c6a69

FWIW, that bugmon regression-range didn't actually identify a regression; it's just that this bug's testcase/prefs.js-file make use of silent printing, which didn't work on Linux for a while, and bug 1471854 (in that pushlog range) fixed it so that it started working again.

(Similar to bug 1699861 comment 4, which has the same bugmon "regression range".)

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20210318160736-0438c8585f5f) but not with tip (mozilla-central 20211203213802-92df9c655be5.)
The bug appears to have been fixed in the following build range:

Start: f5cb6b2465f3042f3ec5bb096a75fbe24f71465e (20211116073345)
End: 5d32dbafda59a62fba936250375782a4cc9c6300 (20211116082732)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=f5cb6b2465f3042f3ec5bb096a75fbe24f71465e&tochange=5d32dbafda59a62fba936250375782a4cc9c6300
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.