Yep, there in ToT. Note you have to make the window small enough to need scrolling.

You are probably looking for a change made after 411559 (known good), but no later than 411563 (first known bad).
CHANGELOG URL:
  https://chromium.googlesource.com/chromium/src/+log/3831b72130f11ebac151fd4945719f6d7489e048..f7d24bd8050b6bf21e6280f12103f0c311e18f4f

Suspect:
https://chromium.googlesource.com/chromium/src/+/971a9c9725e293bd89b7cb1475acdc502065e6b3

Seems a visual rect issue.

This issue is marked as Release Block Beta.Please note that we're promoting M54 Dev to Beta on Thursday, 09/08. 

Walter,do you think we can go with this bug to M54 beta?If yes, please tag with Release Block Stable and plan to fix/revert asap and request a merge to M54. We could take it for upcoming Beta release next week.

I believe it is ok to go to beta with this bug.

It is my understanding that vertical-rl sees niche usage mainly for a small subset of Asian news content sites, and the bug is such that it will produce paint artifacting below the content when scrolling. That is, the contents themselves should still be digestible.

It is an unsightly regression and we need to fix it and merge, but it does not seem like a beta blocker to me unless kojii@ feels otherwise.

Actually, I just double checked and some content in the test case is unreadable toward the bottom of the page, which means that could be the case in the real world as well.

Let me put it back on beta blocker and see if I can come up with a fix quickly.

The document background has an incorrect visual rect:

{index: 1, client: "0x373efcc04018 LayoutView #document", type: "DrawingDocumentBackground", rect: [-1290.000000,0.000000 2090.000000x585.000000], cacheIsValid: true, visualRect: [1290,0 2090x585]},

Resizing as another data point, with less content scrolled off, is similarly:

{index: 1, client: "0x373efcc04018 LayoutView #document", type: "DrawingDocumentBackground", rect: [-476.000000,0.000000 2090.000000x585.000000], cacheIsValid: true, visualRect: [476,0 2090x585]},

Capturing summary from review/discussion today:

When we compute LayoutView's paint invalidation rect, which is used directly as its visual rect, we start in PaintInvalidationState.cpp slowMapToVisualRectInAncestorSpace(), where we un-flip as we always do (see TODO there) so that we begin with plain physical coordinates. We then call LayoutView::mapToVisualRectInAncestorSpace() directly, which does exactly no additional flipping. But in fact in this case where we have vertical-rl on the html style directly, we *do* need to flip.

In the common case, where we traverse into a call to LayoutView::mapToVisualRectInAncestorSpace() after mapping through other preceding LayoutBoxes, flipped blocks flipping is handled within LayoutBox::mapToVisualRectInAncestorSpace() as:

        topLeft.moveBy(topLeftLocation(toLayoutBox(container)));

where topLeftLocation() flips the rect as needed relative to its container.

LayoutView is special in that its background is painted by ViewPainter rather than BoxPainter. Thus the visual rect is incorrect for DisplayItem type 'DrawingDocumentBackground', but not for other BoxPainter produced 'DrawingBoxDecorationBackground' items. ViewPainter paintings may (I have not yet confirmed) be the only case where LayoutView is used as a DisplayItemClient.

The test case passes (and other tests look still ok) if we override LayoutView::visualRect() and flip its stored paint invalidation rect before returning it.

So, three current thoughts on fixes:

1. Override LayoutView::visualRect() as described above, add a comment to document the situation.

2. Revise ViewPainter to use the appropriate GraphicsLayer, whichever one is appropriate as described in:

https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/frame/VisualViewport.cpp?q=visualviewport.cpp&sq=package:chromium&dr&l=351

as the DisplayItemClient for the drawing recorder. This would require also revising the invalidation code to ensure we invalidate that layer. This is semi analogous to what we did for composited scrollers where they use their GraphicsLayer as the DisplayItemClient.

3. Revise LayoutView::mapToVisualRectInAncestorSpace() and potentially callsites to pass along sufficient information, and/or scrutinize layout, layer tree, and frame/scroll state, so as to know when we do/don't need to flip. This could be, in essence, how things worked previously. We removed a flip in LayoutView::mapToVisualRectInAncestorSpace() in https://codereview.chromium.org/2073563002. That removal was correct given the new logic, but it puts us in a situation where now calls that start and end with only mapping through a LayoutView have to be special-cased to have a flip to be correct. Just always flipping in LayoutView is not correct at this point since it will result in over-flipping for call stacks that are not limited to solely LayoutView.

Approach #1 and #2 have the down side that the LayoutView's stored paint invalidation rect is incorrect, but that may not be used for anything. Perhaps hit testing, but can you interact with a LayoutView directly so as to require hit testing on it?

Option 3 could actually be fairly simple -- at a high level, add a param to mapToVisualRectInAncestorSpace() that defaults to false, flip in LayoutView::mapToVisualRectInAncestorSpace() if it's true, and only pass true in the call to LayoutView::mapToVisualRectInAncestorSpace() from slowMapToVisualRectInAncestorSpace().

We could use an alternate method name for use by the one callsite used in slowMapToVisualRectInAncestorSpace() to make things clearer. It would be unfortunate to have to add further param complexity to mapToVisualRectInAncestorSpace() which already has four in one variant, of which two are bit flags. Neither of the bit flags look like they'd make sense for us to add to for this purpose.

I plan to try out #3, will fall back to #1 if things get messy, and look forward to further thoughts on the morrow.

http://crrev.com/2311183004 in review.

This issue is tagged as Release block Beta. M54 Beta promotion RC cut is @4.00 PM PST today( 09/07). 

If you think that it can wait until next week, please tag as Release Block Stable an plan a fix asap.We can take for next weeks Beta Release.Ensure that the issue is baked in canary and verified before merging.

I think it can wait til next week. It's a beta and the issue is niche. I am not sure it will land by 4pm.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/397fa7cad90b8ca7537de21e18949fada5d83c32

commit 397fa7cad90b8ca7537de21e18949fada5d83c32
Author: wkorman <wkorman@chromium.org>
Date: Thu Sep 08 01:12:27 2016

Don't un-flip if we're only mapping for one object.

BUG= 644122 

Review-Url: https://codereview.chromium.org/2318033003
Cr-Commit-Position: refs/heads/master@{#417141}

[modify] https://crrev.com/397fa7cad90b8ca7537de21e18949fada5d83c32/third_party/WebKit/LayoutTests/TestExpectations
[add] https://crrev.com/397fa7cad90b8ca7537de21e18949fada5d83c32/third_party/WebKit/LayoutTests/paint/invalidation/document-flipped-blocks-writing-mode-scroll-expected.png
[add] https://crrev.com/397fa7cad90b8ca7537de21e18949fada5d83c32/third_party/WebKit/LayoutTests/paint/invalidation/document-flipped-blocks-writing-mode-scroll-expected.txt
[add] https://crrev.com/397fa7cad90b8ca7537de21e18949fada5d83c32/third_party/WebKit/LayoutTests/paint/invalidation/document-flipped-blocks-writing-mode-scroll.html
[modify] https://crrev.com/397fa7cad90b8ca7537de21e18949fada5d83c32/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/72cb1870aae913f0b2221fd416f75a7f58e1c01c

commit 72cb1870aae913f0b2221fd416f75a7f58e1c01c
Author: Rebaseline Bot <blink-rebaseline-bot@chromium.org>
Date: Thu Sep 08 02:27:33 2016

Auto-rebaseline for r417141

https://chromium.googlesource.com/chromium/src/+/397fa7cad

BUG= 644122 
TBR=wkorman@chromium.org

Review URL: https://codereview.chromium.org/2325493003 .

Cr-Commit-Position: refs/heads/master@{#417170}

[modify] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/window-resize-vertical-writing-mode-expected.txt
[rename] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/platform/linux/paint/invalidation/document-flipped-blocks-writing-mode-scroll-expected.png
[add] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/platform/mac-mac10.9/paint/invalidation/document-flipped-blocks-writing-mode-scroll-expected.png
[modify] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/window-resize-vertical-writing-mode-expected.txt
[add] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/platform/mac/paint/invalidation/document-flipped-blocks-writing-mode-scroll-expected.png
[modify] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/platform/win/fast/repaint/window-resize-vertical-writing-mode-expected.txt
[add] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/platform/win/paint/invalidation/document-flipped-blocks-writing-mode-scroll-expected.png

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/72cb1870aae913f0b2221fd416f75a7f58e1c01c

commit 72cb1870aae913f0b2221fd416f75a7f58e1c01c
Author: Rebaseline Bot <blink-rebaseline-bot@chromium.org>
Date: Thu Sep 08 02:27:33 2016

Auto-rebaseline for r417141

https://chromium.googlesource.com/chromium/src/+/397fa7cad

BUG= 644122 
TBR=wkorman@chromium.org

Review URL: https://codereview.chromium.org/2325493003 .

Cr-Commit-Position: refs/heads/master@{#417170}

[modify] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/window-resize-vertical-writing-mode-expected.txt
[rename] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/platform/linux/paint/invalidation/document-flipped-blocks-writing-mode-scroll-expected.png
[add] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/platform/mac-mac10.9/paint/invalidation/document-flipped-blocks-writing-mode-scroll-expected.png
[modify] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/window-resize-vertical-writing-mode-expected.txt
[add] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/platform/mac/paint/invalidation/document-flipped-blocks-writing-mode-scroll-expected.png
[modify] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/platform/win/fast/repaint/window-resize-vertical-writing-mode-expected.txt
[add] https://crrev.com/72cb1870aae913f0b2221fd416f75a7f58e1c01c/third_party/WebKit/LayoutTests/platform/win/paint/invalidation/document-flipped-blocks-writing-mode-scroll-expected.png

This seems to have been auto-merged. I checked the branch yesterday and saw it in branch history.

Also confirmed that the original test case on this bug passes on today's Win Canary 55.0.2854.2 which includes r417141.

Has it been merged into m-54 (2840)?

Auto-merged? I haven't heard of such a thing.

Ah, on re-check it looks like it has not, I ran incorrect git log command when I checked for c19. Reopening to merge.

> Auto-merged? I haven't heard of such a thing.

Obviously you haven't worked on Android. :) But separately what happened in c18? Somehow it was tagged with 'merge-merged-2854' (which I realize isn't the right branch number).

That was the rebaseline bot having fun it seems. Email quentin?

I think the merge was by someone (pm?) working on the canary release to include the latest changes in trunk into the canary release branch.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7b6860dfb16d21b832d3e163ebd1b8b336814d9d

commit 7b6860dfb16d21b832d3e163ebd1b8b336814d9d
Author: Walter Korman <wkorman@chromium.org>
Date: Fri Sep 09 20:54:56 2016

Don't un-flip if we're only mapping for one object.

BUG= 644122 

Review-Url: https://codereview.chromium.org/2318033003
Cr-Commit-Position: refs/heads/master@{#417141}
(cherry picked from commit 397fa7cad90b8ca7537de21e18949fada5d83c32)

Review URL: https://codereview.chromium.org/2323403003 .

Cr-Commit-Position: refs/branch-heads/2840@{#281}
Cr-Branched-From: 1ae106dbab4bddd85132d5b75c670794311f4c57-refs/heads/master@{#414607}

[modify] https://crrev.com/7b6860dfb16d21b832d3e163ebd1b8b336814d9d/third_party/WebKit/LayoutTests/TestExpectations
[add] https://crrev.com/7b6860dfb16d21b832d3e163ebd1b8b336814d9d/third_party/WebKit/LayoutTests/paint/invalidation/document-flipped-blocks-writing-mode-scroll-expected.png
[add] https://crrev.com/7b6860dfb16d21b832d3e163ebd1b8b336814d9d/third_party/WebKit/LayoutTests/paint/invalidation/document-flipped-blocks-writing-mode-scroll-expected.txt
[add] https://crrev.com/7b6860dfb16d21b832d3e163ebd1b8b336814d9d/third_party/WebKit/LayoutTests/paint/invalidation/document-flipped-blocks-writing-mode-scroll.html
[modify] https://crrev.com/7b6860dfb16d21b832d3e163ebd1b8b336814d9d/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

Verified the issue on windows 10, Ubuntu 14.04 and Mac 10.11.6 using chrome beta version #54.0.2840.27 as per the comment #0
Observed that the fix is working as expected.

Attaching screencast for reference

Hence, adding the verified labels.

Deleted: 644122.mp4 562 KB

	644122.mp4 562 KB View Download

Confirmed too, thank you Walter!

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7b6860dfb16d21b832d3e163ebd1b8b336814d9d

commit 7b6860dfb16d21b832d3e163ebd1b8b336814d9d
Author: Walter Korman <wkorman@chromium.org>
Date: Fri Sep 09 20:54:56 2016

Don't un-flip if we're only mapping for one object.

BUG= 644122 

Review-Url: https://codereview.chromium.org/2318033003
Cr-Commit-Position: refs/heads/master@{#417141}
(cherry picked from commit 397fa7cad90b8ca7537de21e18949fada5d83c32)

Review URL: https://codereview.chromium.org/2323403003 .

Cr-Commit-Position: refs/branch-heads/2840@{#281}
Cr-Branched-From: 1ae106dbab4bddd85132d5b75c670794311f4c57-refs/heads/master@{#414607}

[modify] https://crrev.com/7b6860dfb16d21b832d3e163ebd1b8b336814d9d/third_party/WebKit/LayoutTests/TestExpectations
[add] https://crrev.com/7b6860dfb16d21b832d3e163ebd1b8b336814d9d/third_party/WebKit/LayoutTests/paint/invalidation/document-flipped-blocks-writing-mode-scroll-expected.png
[add] https://crrev.com/7b6860dfb16d21b832d3e163ebd1b8b336814d9d/third_party/WebKit/LayoutTests/paint/invalidation/document-flipped-blocks-writing-mode-scroll-expected.txt
[add] https://crrev.com/7b6860dfb16d21b832d3e163ebd1b8b336814d9d/third_party/WebKit/LayoutTests/paint/invalidation/document-flipped-blocks-writing-mode-scroll.html
[modify] https://crrev.com/7b6860dfb16d21b832d3e163ebd1b8b336814d9d/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp