In nsCanvasFrame::BuildDisplayList, only capture background items we create in our blend container item instead of any items that might be in the display list already.
When we call nsCanvasFrame::BuildDisplayList from nsHTMLScrollFrame::BuildDisplayList there is already a compositor hit test item in it, created here https://searchfox.org/mozilla-central/rev/ff08e36e1f368bd193b54f569dbd79105b50f9a0/layout/generic/nsGfxScrollFrame.cpp#4146
If we create a blend container item in nsCanvasFrame::BuildDisplayList it puts everything that might already exist in the display list inside the blend container item. It should only do this for the background items that we just created as this is for background blend mode, we are only blending within the background of this frame.
In the fuzz testcase we then have a partial display list build that visits the root scroll frame (because a scroll bar is dirty), so it builds the compositor hit test item for the canvas frame (the child of the scroll frame), but canvas frame is not modified, so we don't descend into it, and we don't call nsCanvasFrame::BuildDisplayList, so the compositor hit test item does not get wrapped in the blend container, and thus it has moved in the display list without being marked modified.
Differential Revision: https://phabricator.services.mozilla.com/D209511
bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1870415
gecko-commit: 1ddb32136a37311b0c602968eda38e113c40ffe7
gecko-reviewers: mstange, layout-reviewers, emilio