Summary: | REGRESSION (r286982): ASSERTION FAILED: clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType] | ||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Ryan Haddad <ryanhaddad> | ||||||||||||||
Component: | Layout and Rendering | Assignee: | cathiechen <cathiechen> | ||||||||||||||
Status: | RESOLVED FIXED | ||||||||||||||||
Severity: | Normal | CC: | bfulgham, cathiechen, changseok, esprehn+autocc, ews-watchlist, fred.wang, glenn, kondapallykalyan, ntim, pdr, rbuis, simon.fraser, webkit-bot-watchers-bugzilla, webkit-bug-importer, zalan | ||||||||||||||
Priority: | P2 | Keywords: | InRadar | ||||||||||||||
Version: | WebKit Nightly Build | ||||||||||||||||
Hardware: | Unspecified | ||||||||||||||||
OS: | Unspecified | ||||||||||||||||
Attachments: |
|
Description
Ryan Haddad
2021-12-14 14:09:40 PST
Created attachment 447933 [details] WIP-patch Looks like it hits this assert. ASSERT(clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType]); IIUC, `m_clipRectsRoot` of ClipRectsCache is set while `updateLayerPositions()` which happens after layout. And `clipRectsContext.rootLayer` comes from `paintInfo.rootLayer`. Looks like the rootLayer is changed in RenderLayer::paintLayerByApplyingTransform(see [1]). Also happens in RenderLayer::hitTestLayerByApplyingTransform(see [2]). Then the assert doesn't pass. Regarding the approach, I tried to update `m_clipRectsRoot` of ClipRectsCache, it seems not work, for there are other layers don't has transform. So maybe we shouldn't let the transform layers use the clipRects in `m_clipRectsRoot`, i.e, use TemporaryClipRects instead. The WIP patch is attached, not sure if this makes sense or not? [1] https://webkit-search.igalia.com/webkit/source/Source/WebCore/rendering/RenderLayer.cpp#3495 [2] https://webkit-search.igalia.com/webkit/source/Source/WebCore/rendering/RenderLayer.cpp#4333 Created attachment 448494 [details]
Patch
Created attachment 448497 [details]
Patch
Comment on attachment 448497 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=448497&action=review > Source/WebCore/rendering/RenderLayer.cpp:4457 > + if (establishesTopLayer() && !parent()->establishesTopLayer()) Even if both this and parent establish a top layer, they are in separate top layers so I think you should just check establishesTopLayer(). Comment on attachment 448497 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=448497&action=review >> Source/WebCore/rendering/RenderLayer.cpp:4457 >> + if (establishesTopLayer() && !parent()->establishesTopLayer()) > > Even if both this and parent establish a top layer, they are in separate top layers so I think you should just check establishesTopLayer(). Done! Thanks! Created attachment 448563 [details]
Patch
Still crash in "mac-AS-debug-wk2" of EWS, it seems the crash exists before the patch. See, https://bugs.webkit.org/show_bug.cgi?id=230079 (In reply to cathiechen from comment #9) > Still crash in "mac-AS-debug-wk2" of EWS, it seems the crash exists before > the patch. See, https://bugs.webkit.org/show_bug.cgi?id=230079 It may make sense to change the patch to skip top-layer-ancestor-opacity-and-transform-crash.html on Mac Debug with bug 230079 as reference. (In reply to Rob Buis from comment #10) > (In reply to cathiechen from comment #9) > > Still crash in "mac-AS-debug-wk2" of EWS, it seems the crash exists before > > the patch. See, https://bugs.webkit.org/show_bug.cgi?id=230079 > > It may make sense to change the patch to skip > top-layer-ancestor-opacity-and-transform-crash.html on Mac Debug with bug > 230079 as reference. Done! Thanks, Rob! Created attachment 448725 [details]
[fast-cq] Patch
Comment on attachment 448725 [details] [fast-cq] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=448725&action=review > Source/WebCore/ChangeLog:11 > + treated as a root layer. When the tranformed layer updates its clip rects, the root layer won't tranformed Comment on attachment 448725 [details]
[fast-cq] Patch
Win failure is false alarm.
Comment on attachment 448725 [details]
[fast-cq] Patch
let me address simon's comment first
Created attachment 448776 [details]
[fast-cq] Patch for landing
Committed r287847 (245896@main): <https://commits.webkit.org/245896@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 448776 [details]. Thanks, Tim and Simon! |