Doing some quick testing, it's enabling OOP rasterization that triggers the issue.

Thanks for filing the issue!

Able to reproduce the issue on reported chrome version 69.0.3497.57 using Mac 10.13.1. The issue seems to be fixed in latest canary 70.0.3534.0. As this issue looks very similar to  Issue 850021 , cc'ing the owner from that bug for further inputs. Tentatively marking it as Untriaged.

@rsesek: Please let us know if this can be duped into above mentioned issue.

No, this is not related to  issue 850021  if this is related to enable-oop-rasterization.

This seems to be related to OOP-R so I'm reassigning to enne@.

I'm not able to repro it for 71.0.3543.0, so seems like it's already fixed for M70. And we don't plan to turn on OOP raster in M69.

I'm still curious about what fixed is to understand what the regression was. I ran a bisect and this is the range it came back with: https://chromium.googlesource.com/chromium/src/+log/0d271f583489024e3c163f0538d1ec29097b3615..3ac27e82be37b5c1a576ed90989b01799ee18d0a. No particular change jumps out to me as oop specific, I'm running another bisect with local builds on this range to narrow it down.

It did bisect to my patch: https://chromium-review.googlesource.com/c/chromium/src/+/1161562. :P

Doing a revert locally to verify that the bisect is correct and then understand how this change fixed the bug!?

The bug boils down to an extra member on PaintImage (size_t), that the patch above removed. I tried adding a int32_t and int64_t on that class, and it reproes with int64_t but not int32_t. 0_0

I don't know how the size of this class is causing this bug, we don't memcpy it anywhere in the serialization code. And it's really odd that this is mac specific, if it were a serialization bug. At least on the renderer side I don't see any errors, we send a valid transfer cache entry for the missing image. May be I need to do some debugging on what's happening service side.

Thanks Chris for the debugging suggestions. So I went through the aura native theme code for drawing these controls that we use in fallback cases (https://cs.chromium.org/chromium/src/ui/native_theme/native_theme_base.cc?type=cs&g=0&l=507). This works. I also changed the code to raster the path into a bitmap which is then drawn on the canvas. And that worked too.

So I went back to the code in the GraphicsContextCanvas (https://cs.chromium.org/chromium/src/third_party/blink/renderer/platform/mac/graphics_context_canvas.mm?l=33) and changed it to draw the path version from native theme instead of the bitamp. And that does not work, but removing the additional int64_t member on PaintImage makes it work. Its super weird that an additional member on PaintImage affects drawing a path here...

Finally narrowed this down. The bug is that we are not initializing the matrix here: https://cs.chromium.org/chromium/src/gpu/command_buffer/service/raster_decoder.cc?l=3198, which is applied to the transform in setMatrix ops: https://cs.chromium.org/chromium/src/cc/paint/paint_op_buffer.cc?l=1381. This was resulting in setting arbitrary transforms on the canvas and dropping draws made from GraphicsContextCanvas: https://cs.chromium.org/chromium/src/third_party/blink/renderer/platform/mac/graphics_context_canvas.mm?l=38

This currently only affects mac, because that's the only platform using this op for painting in blink outside of canvas2d. I'll send a patch with a fix+test tomorrow. Marking this as RBS stable since this is a bad bug we should fix for M70.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/48cbd2a19ab2633f4ad5cddfe3d6b30b0ab098dd

commit 48cbd2a19ab2633f4ad5cddfe3d6b30b0ab098dd
Author: Khushal <khushalsagar@chromium.org>
Date: Tue Sep 18 20:02:51 2018

cc/gpu: Fix execution of SetMatrix ops with OOP raster.

We currently leave the original matrix in PlaybackParams uninitialized
in the setup for RasterCHROMIUM commands. Since this matrix is applied
to the matrix in SetMatrix ops during raster, the canvas ends up with
an arbitrary matrix.

R=enne@chromium.org, ericrk@chromium.org
BUG:  877615 

Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I93dd697052a5b08a94dc01a7112a113c66b0025e
Reviewed-on: https://chromium-review.googlesource.com/1228504
Reviewed-by: enne <enne@chromium.org>
Reviewed-by: Eric Karl <ericrk@chromium.org>
Commit-Queue: Khushal <khushalsagar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#592165}
[modify] https://crrev.com/48cbd2a19ab2633f4ad5cddfe3d6b30b0ab098dd/cc/paint/oop_pixeltest.cc
[modify] https://crrev.com/48cbd2a19ab2633f4ad5cddfe3d6b30b0ab098dd/gpu/command_buffer/service/raster_decoder.cc

This bug requires manual review: M70 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: benmason@(Android), kariahda@(iOS), geohsu@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c31cd536b98d234454f45ad597d547c727e2e156
Commit: c31cd536b98d234454f45ad597d547c727e2e156
Author: khushalsagar@chromium.org
Commiter: khushalsagar@chromium.org
Date: 2018-09-20 20:57:57 +0000 UTC
cc/gpu: Fix execution of SetMatrix ops with OOP raster.

We currently leave the original matrix in PlaybackParams uninitialized
in the setup for RasterCHROMIUM commands. Since this matrix is applied
to the matrix in SetMatrix ops during raster, the canvas ends up with
an arbitrary matrix.

R=​enne@chromium.org, ericrk@chromium.org
BUG:  877615 

Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I93dd697052a5b08a94dc01a7112a113c66b0025e
Reviewed-on: https://chromium-review.googlesource.com/1228504
Reviewed-by: enne <enne@chromium.org>
Reviewed-by: Eric Karl <ericrk@chromium.org>
Commit-Queue: Khushal <khushalsagar@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#592165}(cherry picked from commit 48cbd2a19ab2633f4ad5cddfe3d6b30b0ab098dd)
Reviewed-on: https://chromium-review.googlesource.com/1237263
Reviewed-by: Khushal <khushalsagar@chromium.org>
Cr-Commit-Position: refs/branch-heads/3538@{#550}
Cr-Branched-From: 79f7c91a2b2a2932cd447fa6f865cb6662fa8fa6-refs/heads/master@{#587811}

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c31cd536b98d234454f45ad597d547c727e2e156

commit c31cd536b98d234454f45ad597d547c727e2e156
Author: Khushal <khushalsagar@chromium.org>
Date: Thu Sep 20 20:57:57 2018

cc/gpu: Fix execution of SetMatrix ops with OOP raster.

We currently leave the original matrix in PlaybackParams uninitialized
in the setup for RasterCHROMIUM commands. Since this matrix is applied
to the matrix in SetMatrix ops during raster, the canvas ends up with
an arbitrary matrix.

R=​enne@chromium.org, ericrk@chromium.org
BUG:  877615 

Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I93dd697052a5b08a94dc01a7112a113c66b0025e
Reviewed-on: https://chromium-review.googlesource.com/1228504
Reviewed-by: enne <enne@chromium.org>
Reviewed-by: Eric Karl <ericrk@chromium.org>
Commit-Queue: Khushal <khushalsagar@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#592165}(cherry picked from commit 48cbd2a19ab2633f4ad5cddfe3d6b30b0ab098dd)
Reviewed-on: https://chromium-review.googlesource.com/1237263
Reviewed-by: Khushal <khushalsagar@chromium.org>
Cr-Commit-Position: refs/branch-heads/3538@{#550}
Cr-Branched-From: 79f7c91a2b2a2932cd447fa6f865cb6662fa8fa6-refs/heads/master@{#587811}
[modify] https://crrev.com/c31cd536b98d234454f45ad597d547c727e2e156/cc/paint/oop_pixeltest.cc
[modify] https://crrev.com/c31cd536b98d234454f45ad597d547c727e2e156/gpu/command_buffer/service/raster_decoder.cc

 Issue 890089  has been merged into this issue.