New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 643741 link

Starred by 3 users

Issue metadata

Status: Verified
Owner:
Closed: Sep 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 2
Type: Bug



Sign in to add a comment

Incorrect paint invalidation on local backgrounds on scrolled overflow scoller.

Project Member Reported by flackr@chromium.org, Sep 2 2016

Issue description

Version: 55.0.2848.0

If you cause a paint invalidation on a composited overflow scroll element with a locally attached background we issue a paint invalidation at (0, 0) but the actual paint occurs at (-scrollLeft, -scrollTop). This is because we're painting into the scrolling contents layer in the coordinate space of the overflow: scroll element which doesn't include the scroll offset.

Patch to fix is here: https://codereview.chromium.org/2307983002
 
The failure on the bot was the following (with the patch from https://codereview.chromium.org/2264663002):

12:23:55.422 4036 worker/5 paint/selection/selection-within-composited-scroller.html crashed, (stderr lines):
12:23:55.423 4036   [4260:5648:0901/122354:4477727:ERROR:drawingdisplayitem.cpp(100)] x=0 y=1170 47ffffff vs ffd3d3d3
12:23:55.423 4036   [4260:5648:0901/122354:4477743:ERROR:drawingdisplayitem.cpp(100)] x=1 y=1170 47ffffff vs ffd3d3d3
12:23:55.423 4036   [4260:5648:0901/122354:4477743:ERROR:drawingdisplayitem.cpp(100)] x=2 y=1170 47ffffff vs ffd3d3d3
12:23:55.423 4036   [4260:5648:0901/122354:4477743:ERROR:drawingdisplayitem.cpp(100)] x=3 y=1170 47ffffff vs ffd3d3d3
12:23:55.423 4036   [4260:5648:0901/122354:4477743:ERROR:drawingdisplayitem.cpp(100)] x=4 y=1170 47ffffff vs ffd3d3d3
12:23:55.423 4036   [4260:5648:0901/122354:4477743:ERROR:drawingdisplayitem.cpp(100)] x=5 y=1170 47ffffff vs ffd3d3d3
12:23:55.423 4036   [4260:5648:0901/122354:4477743:ERROR:drawingdisplayitem.cpp(100)] x=6 y=1170 47ffffff vs ffd3d3d3
12:23:55.423 4036   [4260:5648:0901/122354:4477743:ERROR:drawingdisplayitem.cpp(100)] x=7 y=1170 47ffffff vs ffd3d3d3
12:23:55.423 4036   [4260:5648:0901/122354:4477743:ERROR:drawingdisplayitem.cpp(100)] x=8 y=1170 47ffffff vs ffd3d3d3
12:23:55.423 4036   [4260:5648:0901/122354:4477743:ERROR:drawingdisplayitem.cpp(100)] x=9 y=1170 47ffffff vs ffd3d3d3
12:23:55.423 4036   [4260:5648:0901/122354:4477759:ERROR:paintcontroller.cpp(621)] "" under-invalidation: display item changed
12:23:55.423 4036   [4260:5648:0901/122354:4477759:ERROR:paintcontroller.cpp(623)] New display item: "{client: \"36B71898 Scrolling Contents Layer\", type: \"DrawingBoxDecorationBackground\", rect: [0.000000,0.000000 200.000000x1620.000000]}"
12:23:55.423 4036   [4260:5648:0901/122354:4477759:ERROR:paintcontroller.cpp(624)] Old display item: "{client: \"36B71898 Scrolling Contents Layer\", type: \"DrawingBoxDecorationBackground\", rect: [0.000000,0.000000 200.000000x1620.000000]}"
12:23:55.423 4036   [4260:5648:0901/122354:4477759:ERROR:paintcontroller.cpp(628)] See http://crbug.com/619103.
12:23:55.423 4036   [4260:5648:0901/122354:4477759:INFO:paintcontroller.cpp(633)] new picture:
12:23:55.423 4036   "{\n  \"cullRect\": {\n    \"left\": 0,\n    \"top\": 0,\n    \"right\": 200,\n    \"bottom\": 1620\n  },\n  \"operations\": [\n    {\n      \"method\": \"drawRect\",\n      \"params\": {\n        \"rect\": {\n          \"left\": 0,\n          \"top\": -450,\n          \"right\": 200,\n          \"bottom\": 1170\n        },\n        \"paint\": {\n          \"textSize\": 12,\n          \"textScaleX\": 1,\n          \"textSkewX\": 0,\n          \"color\": \"#FFD3D3D3\",\n          \"strokeWidth\": 0,\n          \"strokeMiter\": 4,\n          \"flags\": \"AntiAlias\",\n          \"filterLevel\": \"Low\",\n          \"textAlign\": \"Left\",\n          \"strokeCap\": \"Butt\",\n          \"strokeJoin\": \"Miter\",\n          \"styleName\": \"Fill\",\n          \"textEncoding\": \"UTF-8\",\n          \"hinting\": \"Normal\"\n        }\n      }\n    }\n  ]\n}\n"
12:23:55.423 4036   [4260:5648:0901/122354:4477759:INFO:paintcontroller.cpp(634)] old picture:
12:23:55.423 4036   "{\n  \"cullRect\": {\n    \"left\": 0,\n    \"top\": 0,\n    \"right\": 200,\n    \"bottom\": 1620\n  },\n  \"operations\": [\n    {\n      \"method\": \"drawRect\",\n      \"params\": {\n        \"rect\": {\n          \"left\": 0,\n          \"top\": 0,\n          \"right\": 200,\n          \"bottom\": 1620\n        },\n        \"paint\": {\n          \"textSize\": 12,\n          \"textScaleX\": 1,\n          \"textSkewX\": 0,\n          \"color\": \"#FFD3D3D3\",\n          \"strokeWidth\": 0,\n          \"strokeMiter\": 4,\n          \"flags\": \"AntiAlias\",\n          \"filterLevel\": \"Low\",\n          \"textAlign\": \"Left\",\n          \"strokeCap\": \"Butt\",\n          \"strokeJoin\": \"Miter\",\n          \"styleName\": \"Fill\",\n          \"textEncoding\": \"UTF-8\",\n          \"hinting\": \"Normal\"\n        }\n      }\n    }\n  ]\n}\n"
12:23:55.423 4036   current display item list: [{index: 0, client: "36B71898 Scrolling Contents Layer", type: "DrawingBoxDecorationBackground", rect: [0.000000,0.000000 200.000000x1620.000000], cacheIsValid: true, visualRect: [0,0 200x1620]},
12:23:55.423 4036   {index: 1, client: "37420D68 LayoutBlockFlow DIV id='scroller'", type: "ScrollPaintPhaseChildBlockBackgrounds", currentOffset: [0,0], cacheIsValid: false, visualRect: [0,0 200x200]},
12:23:55.423 4036   {index: 2, client: "3741F670 LayoutBlockFlow DIV", type: "DrawingBoxDecorationBackground", rect: [0.000000,0.000000 100.000000x600.000000], cacheIsValid: true, visualRect: [0,0 100x600]},
12:23:55.423 4036   {index: 3, client: "3741F5AC LayoutBlockFlow DIV id='target'", type: "DrawingBoxDecorationBackground", rect: [0.000000,610.000000 200.000000x1000.000000], cacheIsValid: false, visualRect: [0,610 200x1000]},
12:23:55.423 4036   {index: 4, client: "37420D68 LayoutBlockFlow DIV id='scroller'", type: "EndScrollPaintPhaseChildBlockBackgrounds", cacheIsValid: false, visualRect: [0,0 200x200]},
12:23:55.423 4036   {index: 5, client: "37420D68 LayoutBlockFlow DIV id='scroller'", type: "ScrollPaintPhaseForeground", currentOffset: [0,0], cacheIsValid: false, visualRect: [0,0 200x200]},
12:23:55.423 4036   {index: 6, client: "374F4010 InlineTextBox 'test'", type: "DrawingPaintPhaseForeground", rect: [0.000000,610.000000 23.000000x17.000000], cacheIsValid: false, visualRect: [0,610 23x17]},
12:23:55.423 4036   {index: 7, client: "37420D68 LayoutBlockFlow DIV id='scroller'", type: "EndScrollPaintPhaseForeground", cacheIsValid: false, visualRect: [0,0 200x200]}]
12:23:55.423 4036   new display item list: [{index: 0, client: "36B71898 Scrolling Contents Layer", type: "BeginTransform", transform: [1.000000,0.000000,0.000000,1.000000,0.000000,450.000000], cacheIsValid: true},
12:23:55.423 4036   {index: 1, client: "36B71898 Scrolling Contents Layer", type: "DrawingBoxDecorationBackground", rect: [0.000000,0.000000 200.000000x1620.000000], cacheIsValid: true}]
12:23:55.424 4036   [4260:5648:0901/122354:4477774:FATAL:paintcontroller.cpp(674)] Check failed: false. 
12:23:55.424 4036   Backtrace:
12:23:55.424 4036   	base::debug::StackTrace::StackTrace [0x0209ADC7+23]
12:23:55.424 4036   	logging::LogMessage::~LogMessage [0x020E844B+59]
12:23:55.424 4036   	blink::PaintController::checkUnderInvalidation [0x0ADBEB17+839]
12:23:55.424 4036   	blink::PaintController::processNewItem [0x0ADC3036+1558]
12:23:55.424 4036   	blink::PaintController::createAndAppend<blink::DrawingDisplayItem,blink::DisplayItemClient const &,enum blink::DisplayItem::Type const &,WTF::PassRefPtr<SkPicture>,bool &> [0x0ADAA522+114]
12:23:55.424 4036   	blink::DrawingRecorder::~DrawingRecorder [0x0ADAA98E+302]
12:23:55.424 4036   	blink::BoxPainter::paintBoxDecorationBackgroundWithRect [0x159C18C9+1001]
12:23:55.424 4036   	blink::BoxPainter::paintBoxDecorationBackground [0x159C14CE+334]
12:23:55.424 4036   	blink::LayoutBox::paintBoxDecorationBackground [0x15B55F04+36]
12:23:55.424 4036   	blink::BlockPainter::paintObject [0x159B1EA4+116]
12:23:55.424 4036   	blink::LayoutBlock::paintObject [0x15B20904+36]
12:23:55.424 4036   	blink::BlockPainter::paint [0x159B1979+233]
12:23:55.424 4036   	blink::LayoutBlock::paint [0x15B208A4+36]
12:23:55.424 4036   	blink::PaintLayerPainter::paintFragmentWithPhase [0x15A03B22+658]
12:23:55.424 4036   	blink::PaintLayerPainter::paintBackgroundForFragments [0x15A03082+130]
12:23:55.424 4036   	blink::PaintLayerPainter::paintLayerContents [0x15A04912+3042]
12:23:55.424 4036   	blink::CompositedLayerMapping::doPaintTask [0x15C31D23+579]
12:23:55.424 4036   	blink::CompositedLayerMapping::paintContents [0x15C33034+996]
12:23:55.424 4036   	blink::GraphicsLayer::paintWithoutCommit [0x0AC30C33+499]
12:23:55.424 4036   	blink::GraphicsLayer::paint [0x0AC3077C+44]
12:23:55.424 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E086+38]
12:23:55.424 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E136+214]
12:23:55.424 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E136+214]
12:23:55.424 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E136+214]
12:23:55.424 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E136+214]
12:23:55.424 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E136+214]
12:23:55.424 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E136+214]
12:23:55.424 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E136+214]
12:23:55.425 4036   	blink::FrameView::synchronizedPaint [0x1579DFC9+601]
12:23:55.425 4036   	blink::FrameView::updateLifecyclePhasesInternal [0x1579F39A+1306]
12:23:55.425 4036   	blink::FrameView::updateAllLifecyclePhases [0x1579E9E6+38]
12:23:55.425 4036   	blink::Internals::layerTreeAsText [0x00534D02+146]
12:23:55.425 4036   	blink::Iterable<unsigned int,int>::keysForBinding [0x00569246+1814]
12:23:55.425 4036   	blink::Iterable<unsigned int,int>::keysForBinding [0x005692AC+1916]
12:23:55.425 4036   	v8::internal::FunctionCallbackArguments::Call [0x0934FED3+179]
12:23:55.425 4036   	v8::internal::Isolate::typed_array_prototype [0x093E51C8+1800]
12:23:55.425 4036   	v8::internal::Builtin_HandleApiCallAsFunction [0x093E5EA8+552]
12:23:55.425 4036   	v8::internal::Builtin_HandleApiCall [0x093E5B85+165]
12:23:55.425 4036   
12:23:55.425 4036   Backtrace:
12:23:55.425 4036   	base::debug::BreakDebugger [0x020866E7+23]
12:23:55.425 4036   	logging::LogMessage::~LogMessage [0x020E86CD+701]
12:23:55.425 4036   	blink::PaintController::checkUnderInvalidation [0x0ADBEB17+839]
12:23:55.425 4036   	blink::PaintController::processNewItem [0x0ADC3036+1558]
12:23:55.425 4036   	blink::PaintController::createAndAppend<blink::DrawingDisplayItem,blink::DisplayItemClient const &,enum blink::DisplayItem::Type const &,WTF::PassRefPtr<SkPicture>,bool &> [0x0ADAA522+114]
12:23:55.425 4036   	blink::DrawingRecorder::~DrawingRecorder [0x0ADAA98E+302]
12:23:55.425 4036   	blink::BoxPainter::paintBoxDecorationBackgroundWithRect [0x159C18C9+1001]
12:23:55.425 4036   	blink::BoxPainter::paintBoxDecorationBackground [0x159C14CE+334]
12:23:55.425 4036   	blink::LayoutBox::paintBoxDecorationBackground [0x15B55F04+36]
12:23:55.425 4036   	blink::BlockPainter::paintObject [0x159B1EA4+116]
12:23:55.425 4036   	blink::LayoutBlock::paintObject [0x15B20904+36]
12:23:55.425 4036   	blink::BlockPainter::paint [0x159B1979+233]
12:23:55.425 4036   	blink::LayoutBlock::paint [0x15B208A4+36]
12:23:55.425 4036   	blink::PaintLayerPainter::paintFragmentWithPhase [0x15A03B22+658]
12:23:55.425 4036   	blink::PaintLayerPainter::paintBackgroundForFragments [0x15A03082+130]
12:23:55.425 4036   	blink::PaintLayerPainter::paintLayerContents [0x15A04912+3042]
12:23:55.425 4036   	blink::CompositedLayerMapping::doPaintTask [0x15C31D23+579]
12:23:55.425 4036   	blink::CompositedLayerMapping::paintContents [0x15C33034+996]
12:23:55.426 4036   	blink::GraphicsLayer::paintWithoutCommit [0x0AC30C33+499]
12:23:55.426 4036   	blink::GraphicsLayer::paint [0x0AC3077C+44]
12:23:55.426 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E086+38]
12:23:55.426 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E136+214]
12:23:55.426 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E136+214]
12:23:55.426 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E136+214]
12:23:55.426 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E136+214]
12:23:55.426 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E136+214]
12:23:55.426 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E136+214]
12:23:55.426 4036   	blink::FrameView::synchronizedPaintRecursively [0x1579E136+214]
12:23:55.426 4036   	blink::FrameView::synchronizedPaint [0x1579DFC9+601]
12:23:55.426 4036   	blink::FrameView::updateLifecyclePhasesInternal [0x1579F39A+1306]
12:23:55.426 4036   	blink::FrameView::updateAllLifecyclePhases [0x1579E9E6+38]
12:23:55.426 4036   	blink::Internals::layerTreeAsText [0x00534D02+146]
12:23:55.426 4036   	blink::Iterable<unsigned int,int>::keysForBinding [0x00569246+1814]
12:23:55.426 4036   	blink::Iterable<unsigned int,int>::keysForBinding [0x005692AC+1916]
12:23:55.426 4036   	v8::internal::FunctionCallbackArguments::Call [0x0934FED3+179]
12:23:55.426 4036   	v8::internal::Isolate::typed_array_prototype [0x093E51C8+1800]
12:23:55.426 4036   	v8::internal::Builtin_HandleApiCallAsFunction [0x093E5EA8+552]
12:23:55.426 4036   	v8::internal::Builtin_HandleApiCall [0x093E5B85+165]
12:23:55.426 4036   	v8::internal::StackGuard::ThreadLocal::Initialize [0x096E42B4+1108]
12:23:55.426 4036   	Mtxunlock [0x6D7C318D+13]
12:23:55.426 4036   	std::_Iterator_base12::_Adopt [0x0AAA1638+120]
12:23:55.436 4132 [35461/40913] paint/selection/selection-within-composited-scroller.html failed unexpectedly (renderer crashed)
Okay, if I modify the test paint/selection/selection-within-composited-scroller.html to have a local background and ensure that it paints the scroller before it scrolls down this consistently crashes for me on tot. I've attached the modified test.
selection-within-composited-scroller.html
787 bytes View Download
Cc: -chrishtr@chromium.org
Owner: chrishtr@chromium.org
Status: Assigned (was: Started)
Chris, as I understand it you're looking into this bug?
Cc: schenney@chromium.org
+schenney FYI, this is the bug blocking relanding https://codereview.chromium.org/2264663002/ which treats local equivalent backgrounds as local (i.e. lets the gmail scroller be composited with lcd text).
Yes. Now I think the bug is not actually in the under-invalidation checking code, but
in how we bake composited scrolling into DrawingDisplayItems.
Project Member

Comment 6 by bugdroid1@chromium.org, Sep 10 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1e64d5cf1fd26c35ffbe26fbaf6d3033a42c9852

commit 1e64d5cf1fd26c35ffbe26fbaf6d3033a42c9852
Author: chrishtr <chrishtr@chromium.org>
Date: Sat Sep 10 20:46:32 2016

Use a scroll recorder rather than scroll offset for composited-scrolling backgrounds.

BUG= 643741 

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2327243002
Cr-Commit-Position: refs/heads/master@{#417843}

[modify] https://crrev.com/1e64d5cf1fd26c35ffbe26fbaf6d3033a42c9852/third_party/WebKit/Source/core/paint/BoxPainter.cpp

Status: Fixed (was: Assigned)
Verified that the test in https://codereview.chromium.org/2310203002 no longer
has under-invalidation. Closing.
Labels: M-54 Merge-Request-54
Status: Started (was: Fixed)
This CL needs merging into M54, since the regression happened before the branch
point with this patch:

https://codereview.chromium.org/2196583002

Comment 9 by dimu@chromium.org, Sep 12 2016

Labels: -Merge-Request-54 Merge-Approved-54 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M54 (branch: 2840)
Could you please confirm whether this change is baked/verified in Canary and safe to merge?If yes, merge your change to M54 (branch: 2840) so that we could take this for next Beta Release.
Yes.
Project Member

Comment 12 by bugdroid1@chromium.org, Sep 12 2016

Labels: -merge-approved-54 merge-merged-2840
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/01ef7cf074bd42e12f56fefa3fb40586b20d3cbd

commit 01ef7cf074bd42e12f56fefa3fb40586b20d3cbd
Author: Chris Harrelson <chrishtr@chromium.org>
Date: Mon Sep 12 18:23:35 2016

Use a scroll recorder rather than scroll offset for composited-scrolling backgrounds.

BUG= 643741 

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2327243002
Cr-Commit-Position: refs/heads/master@{#417843}
(cherry picked from commit 1e64d5cf1fd26c35ffbe26fbaf6d3033a42c9852)

Review URL: https://codereview.chromium.org/2331083002 .

Cr-Commit-Position: refs/branch-heads/2840@{#305}
Cr-Branched-From: 1ae106dbab4bddd85132d5b75c670794311f4c57-refs/heads/master@{#414607}

[modify] https://crrev.com/01ef7cf074bd42e12f56fefa3fb40586b20d3cbd/third_party/WebKit/Source/core/paint/BoxPainter.cpp

Status: Fixed (was: Started)
Cc: tkonch...@chromium.org
Labels: Needs-Feedback
Tested the same on mac 10.11.6 by opening the html file given in comment #2 and observed that there is no crash on scrolling up/down/left/right in the reported version version 55.0.2848.0  as well.

Please find the screencast

Could you please provide the TEST steps to manually verify the issue from test team end. 
643741.mov
4.5 MB Download
Status: Verified (was: Fixed)
As per #10 & 11 , marking as verified.
Project Member

Comment 16 by bugdroid1@chromium.org, Oct 27 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/01ef7cf074bd42e12f56fefa3fb40586b20d3cbd

commit 01ef7cf074bd42e12f56fefa3fb40586b20d3cbd
Author: Chris Harrelson <chrishtr@chromium.org>
Date: Mon Sep 12 18:23:35 2016

Use a scroll recorder rather than scroll offset for composited-scrolling backgrounds.

BUG= 643741 

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2327243002
Cr-Commit-Position: refs/heads/master@{#417843}
(cherry picked from commit 1e64d5cf1fd26c35ffbe26fbaf6d3033a42c9852)

Review URL: https://codereview.chromium.org/2331083002 .

Cr-Commit-Position: refs/branch-heads/2840@{#305}
Cr-Branched-From: 1ae106dbab4bddd85132d5b75c670794311f4c57-refs/heads/master@{#414607}

[modify] https://crrev.com/01ef7cf074bd42e12f56fefa3fb40586b20d3cbd/third_party/WebKit/Source/core/paint/BoxPainter.cpp

Sign in to add a comment