Title: [287847] trunk
Revision
287847
Author
[email protected]
Date
2022-01-10 11:06:53 -0800 (Mon, 10 Jan 2022)

Log Message

ASSERTION FAILED in RenderLayer::updateClipRects
https://bugs.webkit.org/show_bug.cgi?id=234315

Reviewed by Simon Fraser.

Source/WebCore:

In clippingRootForPainting(), the dialog element uses the top layer as its clipping root layer.
When it caculates the clip rects, it caculates all its ancestors' clip rects and caches them
including the clipping root layer. However, if the ancestor is a transformed layer, it should be
treated as a root layer. When the transformed layer updates its clip rects, the root layer won't
match the one in cache. This patch stops the dialog descendant propagating its clipping root layer
to the ancestors' in cache.

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::clipCrossesPaintingBoundary const):

LayoutTests:

* TestExpectations:

Modified Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (287846 => 287847)


--- trunk/LayoutTests/ChangeLog	2022-01-10 19:03:07 UTC (rev 287846)
+++ trunk/LayoutTests/ChangeLog	2022-01-10 19:06:53 UTC (rev 287847)
@@ -1,3 +1,12 @@
+2022-01-10  Cathie Chen  <[email protected]>
+
+        ASSERTION FAILED in RenderLayer::updateClipRects
+        https://bugs.webkit.org/show_bug.cgi?id=234315
+
+        Reviewed by Simon Fraser.
+
+        * TestExpectations:
+
 2022-01-10  Chris Dumez  <[email protected]>
 
         Resync web-platform-tests/html from upstream

Modified: trunk/LayoutTests/TestExpectations (287846 => 287847)


--- trunk/LayoutTests/TestExpectations	2022-01-10 19:03:07 UTC (rev 287846)
+++ trunk/LayoutTests/TestExpectations	2022-01-10 19:06:53 UTC (rev 287847)
@@ -3949,6 +3949,7 @@
 webkit.org/b/230079 [ Debug ] imported/w3c/web-platform-tests/css/css-transforms/transform-transformed-thead-contains-fixed-position.html [ Skip ]
 webkit.org/b/230079 [ Debug ] imported/w3c/web-platform-tests/css/css-transforms/transform-transformed-tr-contains-fixed-position.html [ Skip ]
 webkit.org/b/230079 [ Debug ] imported/w3c/web-platform-tests/css/css-transforms/transform-transformed-tr-percent-height-child.html [ Skip ]
+webkit.org/b/230079 [ Debug ] fast/layers/top-layer-ancestor-opacity-and-transform-crash.html [ Skip ]
 
 webkit.org/b/230080 [ Release ] imported/w3c/web-platform-tests/css/css-transforms/transform-transformed-tbody-contains-fixed-position.html [ ImageOnlyFailure ]
 webkit.org/b/230080 [ Release ] imported/w3c/web-platform-tests/css/css-transforms/transform-transformed-tfoot-contains-fixed-position.html [ ImageOnlyFailure ]
@@ -5189,8 +5190,6 @@
 
 imported/w3c/web-platform-tests/css/css-shadow-parts/interaction-with-nested-pseudo-class.html [ ImageOnlyFailure ]
 
-webkit.org/b/234315 [ Debug ] fast/layers/top-layer-ancestor-opacity-and-transform-crash.html [ Skip ]
-
 webkit.org/b/183994 imported/w3c/web-platform-tests/css/cssom/css-style-attr-decl-block.html [ Failure ]
 
 # Test is crashing in Debug builds since import.

Modified: trunk/Source/WebCore/ChangeLog (287846 => 287847)


--- trunk/Source/WebCore/ChangeLog	2022-01-10 19:03:07 UTC (rev 287846)
+++ trunk/Source/WebCore/ChangeLog	2022-01-10 19:06:53 UTC (rev 287847)
@@ -1,3 +1,20 @@
+2022-01-10  Cathie Chen  <[email protected]>
+
+        ASSERTION FAILED in RenderLayer::updateClipRects
+        https://bugs.webkit.org/show_bug.cgi?id=234315
+
+        Reviewed by Simon Fraser.
+
+        In clippingRootForPainting(), the dialog element uses the top layer as its clipping root layer.
+        When it caculates the clip rects, it caculates all its ancestors' clip rects and caches them
+        including the clipping root layer. However, if the ancestor is a transformed layer, it should be
+        treated as a root layer. When the transformed layer updates its clip rects, the root layer won't
+        match the one in cache. This patch stops the dialog descendant propagating its clipping root layer
+        to the ancestors' in cache.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::clipCrossesPaintingBoundary const):
+
 2022-01-10  Tim Nguyen  <[email protected]>
 
         REGRESSION(r287683): <dialog> elements inside clipped/overflowed elements are no longer shown

Modified: trunk/Source/WebCore/rendering/RenderLayer.cpp (287846 => 287847)


--- trunk/Source/WebCore/rendering/RenderLayer.cpp	2022-01-10 19:03:07 UTC (rev 287846)
+++ trunk/Source/WebCore/rendering/RenderLayer.cpp	2022-01-10 19:06:53 UTC (rev 287847)
@@ -4457,6 +4457,9 @@
 
 bool RenderLayer::clipCrossesPaintingBoundary() const
 {
+    if (establishesTopLayer())
+        return true;
+
     return parent()->enclosingPaginationLayer(IncludeCompositedPaginatedLayers) != enclosingPaginationLayer(IncludeCompositedPaginatedLayers)
         || parent()->enclosingCompositingLayerForRepaint() != enclosingCompositingLayerForRepaint();
 }
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to