FYI here is a minimization of the layout test that I made.  I think there may be different issues going on in pdr's testcase.

Deleted: vrlbg.html 507 bytes

vrlbg.html 507 bytes View Download

Tien-Ren is going to take this one. Steve, I heard you got somewhere with
it and might have some idea on how to fix? If so, it would help Tien-Ren
get to the bottom of it quicker.

It has something to do with the rects that are used to paint the background into the scrolling contents layer in ViewPainter::PaintBoxDecorationBackground:

https://pastebin.com/raw/SVTJrX5c

The layer's paint record has a "translate" for the scroll offset, followed by a "drawRect" for the background itself, whose rect is positioned to negate the translation.  That kinda makes sense, because the background should cover the layer?  But it means the scroll offset is baked into the paint ops which is weird since the layer's pixels don't depend on the scroll offset.

Then the window gets resized which changes the scroll offset and PaintController sees that the paint ops are different and gets mad that we didn't issue a paint invalidation.  Except we shouldn't need a paint invalidation because the scrolling contents layer's pixels are all the same?

That's as far as I got.

Turns out it is just one missing FlipForWritingMode(). :D

The scroll + counter-scroll thing you observed probably won't affect correctness, but yea I agree it's so lame and it triggers a DCHECK we really should fix it too.

Can you check the following page with your fix:
https://output.jsbin.com/farupod/quiet

In particular, when you resize the window to be wider, do you see corruption like the attached screenshot?

ViewPainter uses a separate path from BoxPainter so I want to make sure we are fixing RLS and not just the non-root overflow scrollers.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6834d228deef92b4708bfac0c5ed8d33bcbbe51b

commit 6834d228deef92b4708bfac0c5ed8d33bcbbe51b
Author: Tien-Ren Chen <trchen@chromium.org>
Date: Mon Mar 05 08:04:38 2018

[Blink/Paint] Fix scrolling content background with writing mode

The paint rect for background in scrolling content layer should be
expanded to the full scrollable rect, i.e. layout overflow rect.

This CL fixes a bug in BoxPainter and BoxPaintInvalidator that we
forgot to convert LayoutBox::LayoutOverflowRect() from flipped
coordinates to physical coordinates for painting and invalidation.

BUG= 787666 

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I4b4c45e910ea1d860e61eece6005263d0a8c708e
Reviewed-on: https://chromium-review.googlesource.com/942485
Commit-Queue: Tien-Ren Chen <trchen@chromium.org>
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Reviewed-by: Steve Kobes <skobes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#540791}
[modify] https://crrev.com/6834d228deef92b4708bfac0c5ed8d33bcbbe51b/third_party/WebKit/LayoutTests/TestExpectations
[add] https://crrev.com/6834d228deef92b4708bfac0c5ed8d33bcbbe51b/third_party/WebKit/LayoutTests/fast/writing-mode/flipped-block-with-local-background-expected.html
[add] https://crrev.com/6834d228deef92b4708bfac0c5ed8d33bcbbe51b/third_party/WebKit/LayoutTests/fast/writing-mode/flipped-block-with-local-background.html
[modify] https://crrev.com/6834d228deef92b4708bfac0c5ed8d33bcbbe51b/third_party/WebKit/LayoutTests/platform/linux/paint/invalidation/window-resize/window-resize-vertical-writing-mode-expected.txt
[modify] https://crrev.com/6834d228deef92b4708bfac0c5ed8d33bcbbe51b/third_party/WebKit/LayoutTests/platform/mac/paint/invalidation/window-resize/window-resize-vertical-writing-mode-expected.txt
[copy] https://crrev.com/6834d228deef92b4708bfac0c5ed8d33bcbbe51b/third_party/WebKit/LayoutTests/platform/win/paint/invalidation/window-resize/window-resize-vertical-writing-mode-expected.txt
[rename] https://crrev.com/6834d228deef92b4708bfac0c5ed8d33bcbbe51b/third_party/WebKit/LayoutTests/virtual/disable-spv175/paint/invalidation/window-resize/window-resize-vertical-writing-mode-expected.txt
[modify] https://crrev.com/6834d228deef92b4708bfac0c5ed8d33bcbbe51b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
[modify] https://crrev.com/6834d228deef92b4708bfac0c5ed8d33bcbbe51b/third_party/WebKit/Source/core/layout/LayoutBox.h
[modify] https://crrev.com/6834d228deef92b4708bfac0c5ed8d33bcbbe51b/third_party/WebKit/Source/core/paint/BoxPaintInvalidator.cpp
[modify] https://crrev.com/6834d228deef92b4708bfac0c5ed8d33bcbbe51b/third_party/WebKit/Source/core/paint/BoxPainter.cpp

Let's merge this to 66.

Please add affected OSs.

Your change meets the bar and is auto-approved for M66. Please go ahead and merge the CL to branch 3359 manually. Please contact milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), josafat@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/735a07310308af9e01c89a436341d0502a3b1f97

commit 735a07310308af9e01c89a436341d0502a3b1f97
Author: Tien-Ren Chen <trchen@chromium.org>
Date: Tue Mar 06 20:22:03 2018

[Blink/Paint] Fix scrolling content background with writing mode

The paint rect for background in scrolling content layer should be
expanded to the full scrollable rect, i.e. layout overflow rect.

This CL fixes a bug in BoxPainter and BoxPaintInvalidator that we
forgot to convert LayoutBox::LayoutOverflowRect() from flipped
coordinates to physical coordinates for painting and invalidation.

BUG= 787666 
TBR=trchen@chromium.org

(cherry picked from commit 6834d228deef92b4708bfac0c5ed8d33bcbbe51b)

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: I4b4c45e910ea1d860e61eece6005263d0a8c708e
Reviewed-on: https://chromium-review.googlesource.com/942485
Commit-Queue: Tien-Ren Chen <trchen@chromium.org>
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Reviewed-by: Steve Kobes <skobes@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#540791}
Reviewed-on: https://chromium-review.googlesource.com/952029
Reviewed-by: Tien-Ren Chen <trchen@chromium.org>
Cr-Commit-Position: refs/branch-heads/3359@{#38}
Cr-Branched-From: 66afc5e5d10127546cc4b98b9117aff588b5e66b-refs/heads/master@{#540276}
[modify] https://crrev.com/735a07310308af9e01c89a436341d0502a3b1f97/third_party/WebKit/LayoutTests/TestExpectations
[add] https://crrev.com/735a07310308af9e01c89a436341d0502a3b1f97/third_party/WebKit/LayoutTests/fast/writing-mode/flipped-block-with-local-background-expected.html
[add] https://crrev.com/735a07310308af9e01c89a436341d0502a3b1f97/third_party/WebKit/LayoutTests/fast/writing-mode/flipped-block-with-local-background.html
[modify] https://crrev.com/735a07310308af9e01c89a436341d0502a3b1f97/third_party/WebKit/LayoutTests/platform/linux/paint/invalidation/window-resize/window-resize-vertical-writing-mode-expected.txt
[modify] https://crrev.com/735a07310308af9e01c89a436341d0502a3b1f97/third_party/WebKit/LayoutTests/platform/mac/paint/invalidation/window-resize/window-resize-vertical-writing-mode-expected.txt
[copy] https://crrev.com/735a07310308af9e01c89a436341d0502a3b1f97/third_party/WebKit/LayoutTests/platform/win/paint/invalidation/window-resize/window-resize-vertical-writing-mode-expected.txt
[rename] https://crrev.com/735a07310308af9e01c89a436341d0502a3b1f97/third_party/WebKit/LayoutTests/virtual/disable-spv175/paint/invalidation/window-resize/window-resize-vertical-writing-mode-expected.txt
[modify] https://crrev.com/735a07310308af9e01c89a436341d0502a3b1f97/third_party/WebKit/Source/core/layout/LayoutBox.cpp
[modify] https://crrev.com/735a07310308af9e01c89a436341d0502a3b1f97/third_party/WebKit/Source/core/layout/LayoutBox.h
[modify] https://crrev.com/735a07310308af9e01c89a436341d0502a3b1f97/third_party/WebKit/Source/core/paint/BoxPaintInvalidator.cpp
[modify] https://crrev.com/735a07310308af9e01c89a436341d0502a3b1f97/third_party/WebKit/Source/core/paint/BoxPainter.cpp