Looks a bit like the inverse of the scale from the 'transform' is applied...

Trying to bisect between 58.0.3029.96 and 59.0.3071.115 I get the same result in both as in the 59 screenshot. This was not on Windows though, so hopefully someone can attempt to bisect there.

Able to reproduce the issue using #59.0.3071.115 on Win 10, Mac 10.12.5 and Linux Ubuntu 14.04

Using the per-revision bisect providing the bisect results,

Good build: 57.0.2937.0 (Revision: 435110).
Bad build:  57.0.2938.0 (Revision: 435514).

You are probably looking for a change made after 435336 (known good), but no later than 435337 (first known bad).

CHANGELOG URL
---------------
https://chromium.googlesource.com/chromium/src/+log/6003cf9974cf584ae8523e02a0bc001178fb73ae..f451d9b5de5a1b4691d60d8c74341ac8a466cf57

From the CL above, assigning the issue to the concern owner

@wangxianzhu: Could you please look into the issue, pardon me if it has nothing to do with your changes and if possible please assign it to concern owner.

Review-Url: https://codereview.chromium.org/2536493002


Thanks.

Issue is seen in M61 as well.

I'm pretty sure that blamed patch was reverted. I'll look into that as soon as I get a chance, which should be sooner than wangxianzhu@ can look at it.

A gentle Reminder, As this is blocking application.

pdr@, this is the foreign object geometry bug I was talking about.

Minimized repro

We're counting the x and y offsets twice.

Deleted: fo.html 434 bytes

fo.html 434 bytes View Download

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8e4d4abfb281a12d5e972e8d8edec3d5db53fcac

commit 8e4d4abfb281a12d5e972e8d8edec3d5db53fcac
Author: pdr <pdr@chromium.org>
Date: Thu Aug 03 23:26:08 2017

Only include position once in foreign object client rects

SVG's foreign object coordinate spaces were recently updated [1] to
clarify SVG coordinates vs HTML coordinates. SVG coordinates are
equal to HTML coordinates plus location (x and y). LayoutSVGBlock's
MapLocalToAncestor takes HTML coordinates and offsets by location.

Element::ClientQuads passed ObjectBoundingBox, which is in SVG coordinates
and includes location, to MapLocalToAncestor which would apply the
location offset twice. This patch updates Element::ClientQuads to use
AbsoluteQuads which correctly calculates the foreign object bounds.

Two TODOs have been added:
1) Element::ClientQuads and Element::BoundsInViewport are very similar and
should be unified.
2) It's not clear whether stroke should be included in Element::ClientQuads.
If it should be, SVG special-cases can be removed from Element::ClientQuads.
A spec question has been filed: https://github.com/w3c/svgwg/issues/339.

[1] https://chromium.googlesource.com/chromium/src/+/09a6cd640fb5bf07aa06477362229c2e6969a718

Bug:  741615 
Change-Id: Ibec65966e8661c4c2390284708ef53b5d0c1d11a
Reviewed-on: https://chromium-review.googlesource.com/597487
Commit-Queue: Philip Rogers <pdr@chromium.org>
Reviewed-by: Fredrik Söderquist <fs@opera.com>
Cr-Commit-Position: refs/heads/master@{#491875}
[modify] https://crrev.com/8e4d4abfb281a12d5e972e8d8edec3d5db53fcac/third_party/WebKit/Source/core/dom/Element.cpp
[modify] https://crrev.com/8e4d4abfb281a12d5e972e8d8edec3d5db53fcac/third_party/WebKit/Source/core/dom/ElementTest.cpp