Looks like a paint issue?

Incorrect bisect range was given. Bisect goes down to this, which is much older.

https://chromium.googlesource.com/chromium/src/+log/27f47452ef102d6430ca500fd4a27d8edf6de832..888e0654737e05ee063a10654e521c0d7c7d0ee4

Of which this is the plausible candidate.
https://chromium.googlesource.com/chromium/src/+/4fa3275a1ee7439fb7057ac2d9986c15c9a2e396

Having looked at the menu open about 500 times, we seem to be broken after a change that makes the painted content appear 1 frame later than the box grows due to animation, and we fail when we do not paint the final animation frame. Mousing over fixes it, which is probably why it went unreported for so long (or maybe the content changed).

My other thought was that this is partial-raster, but the bisect doesn't show that and I re-did the bisect twice.

I can confirm that it was the patch referenced in comment 3.

able to reproduce the issue on windows 7 using chrome version 60.0.3112.24.
chrishtr@ Could you please look into this stable blocker issue.

Thanks, 

I can reproduce this issue, and have a potential fix.

Gentle ping to chrishtr@ about the fix.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2f502a91eb07a2c8f68f9c83d250a5d39c76327f

commit 2f502a91eb07a2c8f68f9c83d250a5d39c76327f
Author: Chris Harrelson <chrishtr@chromium.org>
Date: Wed Jun 28 02:24:08 2017

Refactor to only need to check cull rect changes up to containing transform.

This allows us to
(a) simplify the PrePaintTree walk code, and make it faster
and
(b) makes cull rects for transforms SPv2-compatible, because we can't cull them
out if they might end up composited

Details:
1. Stop culling out CSS transformed elements and passing along cull rects from above
the transform. This change means that we don't need to worry about any cull rects
of a transform or from outside of it.
2. Simplify cull rect change detection logic in PrePaintTreeWalk and
PaintPropertyTreeBuilder to check only for whether a clip rect changed, or was
added/removed, between self and containing transform. This is made possible by #1.
3. Stop optimizing out paint invalidations for empty visual rects under transform.
This avoids paint under-invalidation failures in cases when a transform was
previously clipped out.
4. Remove ancestor_transformed_or_root_paint_layer from the pre-paint tree
walk context.


Bug:  729514 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: Ic4d8a382c9991c51d4b25c03cb71b406b1ee98ac
Reviewed-on: https://chromium-review.googlesource.com/544024
Commit-Queue: Chris Harrelson <chrishtr@chromium.org>
Reviewed-by: Philip Rogers <pdr@chromium.org>
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#482854}
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/TestExpectations
[add] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/clip-unclip-and-change-expected.txt
[add] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/css-clip-change-stacking-child-expected.txt
[add] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/mask-clip-change-stacking-child-expected.txt
[add] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/paint/invalidation/css-clip-change-stacking-child-expected.txt
[add] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/paint/invalidation/css-clip-change-stacking-child.html
[add] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/paint/invalidation/mask-clip-change-stacking-child-expected.txt
[add] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/paint/invalidation/mask-clip-change-stacking-child.html
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/platform/linux/fast/borders/border-antialiasing-expected.png
[add] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/platform/linux/http/tests/security/xssAuditor/object-src-inject-expected.txt
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/platform/linux/paint/invalidation/svg/animated-path-inside-transformed-html-expected.txt
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/platform/linux/paint/invalidation/svg/window-expected.txt
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/platform/mac/paint/invalidation/svg/animated-path-inside-transformed-html-expected.txt
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/platform/mac/paint/invalidation/svg/window-expected.txt
[add] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/platform/win/http/tests/security/xssAuditor/object-src-inject-expected.txt
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/platform/win/paint/invalidation/svg/animated-path-inside-transformed-html-expected.txt
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/platform/win/paint/invalidation/svg/window-expected.txt
[add] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/LayoutTests/platform/win7/http/tests/security/xssAuditor/object-src-inject-expected.txt
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/Source/core/paint/ObjectPaintInvalidator.cpp
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/Source/core/paint/PaintInvalidationTest.cpp
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/Source/core/paint/PaintInvalidator.h
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/Source/core/paint/PaintLayerPainter.cpp
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.h
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.h
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/Source/core/paint/PrePaintTreeWalkTest.cpp
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/Source/platform/geometry/FloatRoundedRect.h
[modify] https://crrev.com/2f502a91eb07a2c8f68f9c83d250a5d39c76327f/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/36395643b7a7f0157d811d1afe94948d89695a88

commit 36395643b7a7f0157d811d1afe94948d89695a88
Author: Balazs Engedy <engedy@chromium.org>
Date: Wed Jun 28 10:45:30 2017

Rebaseline expectations for http/tests/security/xssAuditor/object-src-inject

As of change Ic4d8a382c9991c51d4b25c03cb71b406b1ee98ac, it consistently results
in different actual text output on WebKit Win10 builders.

Bug:  729514 
Change-Id: I7561eb7a6897255d06b80cf5ea361debc9efe0f9
TBR: chrishtr@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/552117
Commit-Queue: Balazs Engedy <engedy@chromium.org>
Reviewed-by: Balazs Engedy <engedy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#482940}
[delete] https://crrev.com/c39170d3ab61af1c7a5cd231cb13f98bad972da1/third_party/WebKit/LayoutTests/platform/linux/http/tests/security/xssAuditor/object-src-inject-expected.txt
[delete] https://crrev.com/c39170d3ab61af1c7a5cd231cb13f98bad972da1/third_party/WebKit/LayoutTests/platform/win/http/tests/security/xssAuditor/object-src-inject-expected.txt
[delete] https://crrev.com/c39170d3ab61af1c7a5cd231cb13f98bad972da1/third_party/WebKit/LayoutTests/platform/win7/http/tests/security/xssAuditor/object-src-inject-expected.txt

Not marking as releaseblock, as the fix was too dangerous for M60.
Also, this is not an M60 regression, it's an M59 one.

Just to update:

Above issue is still reproducible on Windows, Mac and Linux OS using latest build 63.0.3231.0

Thank you. 

Reduced testcase attached.

Deleted: test.html 425 bytes

test.html 425 bytes View Download

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/05498ef18337e36d5d70527519e0e645a6b14df6

commit 05498ef18337e36d5d70527519e0e645a6b14df6
Author: Chris Harrelson <chrishtr@chromium.org>
Date: Tue Nov 14 22:26:42 2017

Don't optimize out paint optimization invalidations across composited boundaries.

This fixes a bug in which a change to clip on a composited element, combined
with other changes to the element to make it size unchanged, led to failure to
invalidate child subsequence caches. Rather than add complexity to fix this bug,
let's turn of the optimization, as it will not apply to SPv2 anyway, and has
unclear benefit, since almost all of the time the subsequences will invalidate
anyway for other reasons.

Bug:  729514 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I2e2550028c72645908967464000c4894ad67ac91
Reviewed-on: https://chromium-review.googlesource.com/767892
Commit-Queue: Chris Harrelson <chrishtr@chromium.org>
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#516460}
[add] https://crrev.com/05498ef18337e36d5d70527519e0e645a6b14df6/third_party/WebKit/LayoutTests/paint/invalidation/change-clip-composited-layer-expected.html
[add] https://crrev.com/05498ef18337e36d5d70527519e0e645a6b14df6/third_party/WebKit/LayoutTests/paint/invalidation/change-clip-composited-layer.html
[modify] https://crrev.com/05498ef18337e36d5d70527519e0e645a6b14df6/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp