Bug 197818 – REGRESSION (r245208): compositing/shared-backing/sharing-bounds-non-clipping-shared-layer.html asserts

• Component: Compositing
• Status: RESOLVED FIXED

[Simon Fraser (smfr)]

In WK2 iOS-simulator tests, compositing/shared-backing/sharing-bounds-non-clipping-shared-layer.html hits:

ASSERTION FAILED: clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType]
./rendering/RenderLayer.cpp(5483) : Ref<WebCore::ClipRects> WebCore::RenderLayer::updateClipRects(const WebCore::RenderLayer::ClipRectsContext &)
1   0x2daccd1f9 WTFCrash
2   0x2df3c206b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x2e2870ca3 WebCore::RenderLayer::updateClipRects(WebCore::RenderLayer::ClipRectsContext const&)
4   0x2e2871294 WebCore::RenderLayer::parentClipRects(WebCore::RenderLayer::ClipRectsContext const&) const
5   0x2e2865e72 WebCore::RenderLayer::backgroundClipRect(WebCore::RenderLayer::ClipRectsContext const&) const
6   0x2e286c790 WebCore::RenderLayer::calculateRects(WebCore::RenderLayer::ClipRectsContext const&, WebCore::LayoutRect const&, WebCore::LayoutRect&, WebCore::ClipRect&, WebCore::ClipRect&, WebCore::LayoutSize const&) const
7   0x2e286a33f WebCore::RenderLayer::collectFragments(WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow, 16ul>&, WebCore::RenderLayer const*, WebCore::LayoutRect const&, WebCore::RenderLayer::PaginationInclusionMode, WebCore::ClipRectsType, WebCore::OverlayScrollbarSizeRelevancy, WebCore::ShouldRespectOverflowClip, WebCore::LayoutSize const&, WebCore::LayoutRect const*, WebCore::ShouldApplyRootOffsetToFragments)
8   0x2e28670f1 WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
9   0x2e2866541 WebCore::RenderLayer::paintLayerContentsAndReflection(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
10  0x2e2865631 WebCore::RenderLayer::paintLayerWithEffects(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
11  0x2e286489d WebCore::RenderLayer::paintLayer(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
12  0x2e286b0e4 WebCore::RenderLayer::paintList(WebCore::RenderLayer::LayerList, WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
13  0x2e28673e7 WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext&, WebCore::RenderLayer::LayerPaintingInfo const&, WTF::OptionSet<WebCore::RenderLayer::PaintLayerFlag>)
14  0x2e287fc58 WebCore::RenderLayerBacking::updateEventRegion()
15  0x2e287e8de WebCore::RenderLayerBacking::updateConfiguration()
16  0x2e288f451 WebCore::RenderLayerCompositor::updateBackingAndHierarchy(WebCore::RenderLayer&, WTF::Vector<WTF::Ref<WebCore::GraphicsLayer, WTF::DumbPtrTraits<WebCore::GraphicsLayer> >, 0ul, WTF::CrashOnOverflow, 16ul>&, WebCore::ScrollingTreeState&, WTF::OptionSet<WebCore::RenderLayerCompositor::UpdateLevel>, int)
17  0x2e288fa47 WebCore::RenderLayerCompositor::updateBackingAndHierarchy(WebCore::RenderLayer&, WTF::Vector<WTF::Ref<WebCore::GraphicsLayer, WTF::DumbPtrTraits<WebCore::GraphicsLayer> >, 0ul, WTF::CrashOnOverflow, 16ul>&, WebCore::ScrollingTreeState&, WTF::OptionSet<WebCore::RenderLayerCompositor::UpdateLevel>, int)
18  0x2e288fa47 WebCore::RenderLayerCompositor::updateBackingAndHierarchy(WebCore::RenderLayer&, WTF::Vector<WTF::Ref<WebCore::GraphicsLayer, WTF::DumbPtrTraits<WebCore::GraphicsLayer> >, 0ul, WTF::CrashOnOverflow, 16ul>&, WebCore::ScrollingTreeState&, WTF::OptionSet<WebCore::RenderLayerCompositor::UpdateLevel>, int)
19  0x2e285dbad WebCore::RenderLayerCompositor::updateCompositingLayers(WebCore::CompositingUpdateType, WebCore::RenderLayer*)
20  0x2e2076d83 WebCore::FrameView::updateCompositingLayersAfterLayout()
21  0x2e20794c7 WebCore::FrameView::didLayout(WTF::WeakPtr<WebCore::RenderElement>)

Need some TemporaryClipRects stuff somewhere.

[Radar WebKit Bug Importer]

<rdar://problem/50705762>

[Alexey Proskuryakov]

Looks like this is a super recent regression, first crashes on the bots are yesterday. Which of your patches caused this?

[Alexey Proskuryakov]

I guess that must be the one that added the test, <http://trac.webkit.org/r245208>?

[Simon Fraser (smfr)]

Some more logging to help diagnose:

diff --git a/Source/WebCore/platform/Logging.cpp b/Source/WebCore/platform/Logging.cpp
index 899141ce0d39d4151450cf4e1632cdb4ca85af97..ab768bbbb88944bbf79be27a0fe4090f50f9f9b1 100644
--- a/Source/WebCore/platform/Logging.cpp
+++ b/Source/WebCore/platform/Logging.cpp
@@ -78,6 +78,8 @@ void initializeLogChannelsIfNecessary(Optional<String> logChannelString)
 
     String enabledChannelsString = logChannelString ? logChannelString.value() : logLevelString();
     WTFInitializeLogChannelStatesFromString(logChannels, logChannelCount, enabledChannelsString.utf8().data());
+    LogCompositing.state = WTFLogChannelState::On;
+    LogClipRects.state = WTFLogChannelState::On;
 }
 
 WTFLogChannel* getLogChannel(const String& name)
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index 7a1dc38fcf2de78a320e5fc58704156770114d93..d9f1390ae4107b6dc40be3b1c44953342560c209 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -5496,7 +5496,10 @@ Ref<ClipRects> RenderLayer::updateClipRects(const ClipRectsContext& clipRectsCon
     ASSERT(clipRectsType < NumCachedClipRectsTypes);
     if (m_clipRectsCache) {
         if (auto* clipRects = m_clipRectsCache->getClipRects(clipRectsType, clipRectsContext.respectOverflowClip)) {
-            ASSERT(clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType]);
+//            ASSERT(clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType]);
+            if (clipRectsContext.rootLayer != m_clipRectsCache->m_clipRectsRoot[clipRectsType])
+                LOG_WITH_STREAM(ClipRects, stream << "RenderLayer " << this << " updateClipRects " << clipRectsContext << " - mismatched roots, cached is " << m_clipRectsCache->m_clipRectsRoot[clipRectsType]);
+            
             ASSERT(m_clipRectsCache->m_scrollbarRelevancy[clipRectsType] == clipRectsContext.overlayScrollbarSizeRelevancy);
         
 #ifdef CHECK_CACHED_CLIP_RECTS
@@ -5514,6 +5517,7 @@ Ref<ClipRects> RenderLayer::updateClipRects(const ClipRectsContext& clipRectsCon
     if (!m_clipRectsCache)
         m_clipRectsCache = std::make_unique<ClipRectsCache>();
 #ifndef NDEBUG
+    LOG_WITH_STREAM(ClipRects, stream << "RenderLayer " << this << " updateClipRects " << clipRectsContext << " - caching root " << clipRectsContext.rootLayer);
     m_clipRectsCache->m_clipRectsRoot[clipRectsType] = clipRectsContext.rootLayer;
     m_clipRectsCache->m_scrollbarRelevancy[clipRectsType] = clipRectsContext.overlayScrollbarSizeRelevancy;
 #endif

[Simon Fraser (smfr)]

Here's the fix:

diff --git a/Source/WebCore/rendering/RenderLayerBacking.cpp b/Source/WebCore/rendering/RenderLayerBacking.cpp
index f839e46e3ebd04e23439b5a940ac13d3a9bf52a1..6e7398659d9065b99dd72d1e95043a5b5b4a391c 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.cpp
+++ b/Source/WebCore/rendering/RenderLayerBacking.cpp
@@ -1486,7 +1486,7 @@ void RenderLayerBacking::updateEventRegion()
     m_owningLayer.paintLayerContents(nullContext, paintingInfo, paintFlags);
 
     for (auto& layerWeakPtr : m_backingSharingLayers)
-        layerWeakPtr->paintLayerContents(nullContext, paintingInfo, paintFlags);
+        layerWeakPtr->paintLayerWithEffects(nullContext, paintingInfo, paintFlags);
 
     auto contentOffset = roundedIntSize(contentOffsetInCompositingLayer());
     eventRegion.translate(contentOffset);

[Simon Fraser (smfr)]

Antti, can you make a layout test for event regions with transforms and verify the fix?

[Simon Fraser (smfr)]

Created attachment 369692 [details]
Logging and speculative fix

[Simon Fraser (smfr)]

Asserting skipped in r245221, please re-enable when landing.

[Antti Koivisto]

Created attachment 369728 [details]
patch

[Antti Koivisto]

Created attachment 369735 [details]
patch

[WebKit Commit Bot]

Comment on attachment 369735 [details]
patch

Clearing flags on attachment: 369735

Committed r245242: <https://trac.webkit.org/changeset/245242>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.