It's weird that I can reproduce this:
- with bisect,
- on a dev build with a new user-data-dir,
- on ToT local non-official build of chrome;

but not
- on a dev build with the default user-data-dir
- on ToT local build of content_shell.

Added some log in selection_painting_utils.cc, and found that this is actually a theme issue: when the bug reproduces, the colors of active selection and inactive  selection are the same:
active-color="rgba(8, 103, 203, 0.733333333333333)" inactive-color="rgba(8, 103, 203, 0.733333333333333)

When the issue doesn't reproduce, the colors are different:
active-color="rgba(0, 116, 255, 0.8)" inactive-color="rgba(163, 163, 163, 0.6)

I think at least what I observed in #c3 is not a paint issue, but seems intentional with some special theme. I'm not sure if what yoichio@ observed was the same issue.

Did you try with --enable-blink-feature=LayoutNG?

Assigning since there is active work on tracking this down. You should re-assign as the cause/ownership becomes clearer.

Reproduced with content_shell --enable-blink-features=LayoutNG (while not repaiting the selection in gray in chrome seems intended because both the active color and the inactive color of selection background are blue).

Assigning to yoichio@ because this is a LayoutNG paint invalidation issue. You can check if ObjectPaintInvalidator::InvalidateSelection() works properly in LayoutNG mode.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4f0f389fd0abca186fc66e5e2f1ddd639c8b7501

commit 4f0f389fd0abca186fc66e5e2f1ddd639c8b7501
Author: Yoichi Osato <yoichio@chromium.org>
Date: Thu Jul 05 07:48:36 2018

[LayoutNG] Invalidate selected PaintFragment if frame focus is changed

PaintInvalidator for selection only invalidated PaintFragment when its
SelectionRect is changed.
However, if frame looses focus, we repaint its blue selection gray and since
SelectionRect is not changed, we didn't invalidate it.
This patch implements such invalidation.

This patch fixes following test on LayoutNG:
 paint/invalidation/selection/text-selection-rect-in-overflow-2.html
Rebaseline is by selection height 1px diff.

FYI:
LayoutSelection::InvalidatePaintForSelection sets LayoutObject::SetShouldInvalidateSelection()
when focus is changed.

Bug:  856928 
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng;luci.chromium.try:linux_layout_tests_slimming_paint_v2;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Iddde040b3c3be9213151955f087c1825c318779e
Reviewed-on: https://chromium-review.googlesource.com/1122056
Commit-Queue: Yoichi Osato <yoichio@chromium.org>
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#572728}
[add] https://crrev.com/4f0f389fd0abca186fc66e5e2f1ddd639c8b7501/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/paint/invalidation/selection/text-selection-rect-in-overflow-2-expected.png
[add] https://crrev.com/4f0f389fd0abca186fc66e5e2f1ddd639c8b7501/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/paint/invalidation/selection/text-selection-rect-in-overflow-2-expected.txt
[modify] https://crrev.com/4f0f389fd0abca186fc66e5e2f1ddd639c8b7501/third_party/blink/renderer/core/paint/paint_invalidator.cc