Title: [199847] trunk
- Revision
- 199847
- Author
- simon.fra...@apple.com
- Date
- 2016-04-21 17:08:28 -0700 (Thu, 21 Apr 2016)
Log Message
ASSERTION FAILED: accumulation == TransformState::FlattenTransform in WebCore::GraphicsLayerCA::computeVisibleAndCoverageRect
https://bugs.webkit.org/show_bug.cgi?id=155362
Reviewed by Zalan Bujtas.
Source/WebCore:
A particular configuration of composited RenderLayers with preserve-3d and clipping
caused assertions because an ancestor clipping layer had masksToBounds() set, but
a preserves3D() parent, triggering an assertion in GraphicsLayerCA::computeVisibleAndCoverageRect().
Make two changes to address this:
First, CSS clip: and clip-path: should force flattening and override preserve-3d in
the RenderStyle.
Second, don't accumulate transforms in GraphicsLayerCA through layers with masksToBounds().
Tests: compositing/clipping/preserve3d-flatten-assertion-nested.html
compositing/clipping/preserve3d-flatten-assertion.html
* css/StyleResolver.cpp:
(WebCore::StyleResolver::adjustRenderStyle):
* platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::accumulatesTransform):
LayoutTests:
Test cases that should not assert in debug builds.
* compositing/clipping/preserve3d-flatten-assertion-nested.html: Added.
* compositing/clipping/preserve3d-flatten-assertion.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (199846 => 199847)
--- trunk/LayoutTests/ChangeLog 2016-04-21 23:56:03 UTC (rev 199846)
+++ trunk/LayoutTests/ChangeLog 2016-04-22 00:08:28 UTC (rev 199847)
@@ -1,3 +1,15 @@
+2016-04-21 Simon Fraser <simon.fra...@apple.com>
+
+ ASSERTION FAILED: accumulation == TransformState::FlattenTransform in WebCore::GraphicsLayerCA::computeVisibleAndCoverageRect
+ https://bugs.webkit.org/show_bug.cgi?id=155362
+
+ Reviewed by Zalan Bujtas.
+
+ Test cases that should not assert in debug builds.
+
+ * compositing/clipping/preserve3d-flatten-assertion-nested.html: Added.
+ * compositing/clipping/preserve3d-flatten-assertion.html: Added.
+
2016-04-21 Jiewen Tan <jiewen_...@apple.com>
[iOS] DumpRenderTree crashed in com.apple.WebCore: WebCore::ResourceLoadNotifier::didFailToLoad
Added: trunk/LayoutTests/compositing/clipping/preserve3d-flatten-assertion-expected.txt (0 => 199847)
--- trunk/LayoutTests/compositing/clipping/preserve3d-flatten-assertion-expected.txt (rev 0)
+++ trunk/LayoutTests/compositing/clipping/preserve3d-flatten-assertion-expected.txt 2016-04-22 00:08:28 UTC (rev 199847)
@@ -0,0 +1 @@
+This test should not assert in debug builds.
Added: trunk/LayoutTests/compositing/clipping/preserve3d-flatten-assertion-nested-expected.txt (0 => 199847)
--- trunk/LayoutTests/compositing/clipping/preserve3d-flatten-assertion-nested-expected.txt (rev 0)
+++ trunk/LayoutTests/compositing/clipping/preserve3d-flatten-assertion-nested-expected.txt 2016-04-22 00:08:28 UTC (rev 199847)
@@ -0,0 +1 @@
+This test should not assert in debug builds.
Added: trunk/LayoutTests/compositing/clipping/preserve3d-flatten-assertion-nested.html (0 => 199847)
--- trunk/LayoutTests/compositing/clipping/preserve3d-flatten-assertion-nested.html (rev 0)
+++ trunk/LayoutTests/compositing/clipping/preserve3d-flatten-assertion-nested.html 2016-04-22 00:08:28 UTC (rev 199847)
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+
+<html>
+<head>
+ <style>
+ .box {
+ height: 200px;
+ width: 200px;
+ margin: 10px;
+ border: 1px solid black;
+ }
+ .middle {
+ position: absolute;
+ transform: translateZ(0);
+ transform-style: preserve-3d;
+ }
+
+ .clipping {
+ position: absolute;
+ overflow: hidden;
+ }
+
+ .composited {
+ transform: translateZ(0);
+ }
+ </style>
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ </script>
+</head>
+<body>
+ <div class="middle box">
+ <div class="clipping box">
+ <div class="composited box">
+ This test should not assert in debug builds.
+ </div>
+ </div>
+ </div>
+</body>
+</html>
Added: trunk/LayoutTests/compositing/clipping/preserve3d-flatten-assertion.html (0 => 199847)
--- trunk/LayoutTests/compositing/clipping/preserve3d-flatten-assertion.html (rev 0)
+++ trunk/LayoutTests/compositing/clipping/preserve3d-flatten-assertion.html 2016-04-22 00:08:28 UTC (rev 199847)
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+
+<html>
+<head>
+ <style>
+ .box {
+ height: 300px;
+ width: 300px;
+ padding: 10px;
+ position: absolute;
+ border: 1px solid black;
+ transform: translateZ(0);
+ transform-style: preserve-3d;
+ clip: rect(10px, 200px, 200px, 10px);
+ }
+ </style>
+ <script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+ </script>
+</head>
+<body>
+<div class="box">
+ <div class="box">
+ This test should not assert in debug builds.
+ </div>
+</div>
+</body>
+</html>
Modified: trunk/Source/WebCore/ChangeLog (199846 => 199847)
--- trunk/Source/WebCore/ChangeLog 2016-04-21 23:56:03 UTC (rev 199846)
+++ trunk/Source/WebCore/ChangeLog 2016-04-22 00:08:28 UTC (rev 199847)
@@ -1,3 +1,28 @@
+2016-04-21 Simon Fraser <simon.fra...@apple.com>
+
+ ASSERTION FAILED: accumulation == TransformState::FlattenTransform in WebCore::GraphicsLayerCA::computeVisibleAndCoverageRect
+ https://bugs.webkit.org/show_bug.cgi?id=155362
+
+ Reviewed by Zalan Bujtas.
+
+ A particular configuration of composited RenderLayers with preserve-3d and clipping
+ caused assertions because an ancestor clipping layer had masksToBounds() set, but
+ a preserves3D() parent, triggering an assertion in GraphicsLayerCA::computeVisibleAndCoverageRect().
+ Make two changes to address this:
+
+ First, CSS clip: and clip-path: should force flattening and override preserve-3d in
+ the RenderStyle.
+
+ Second, don't accumulate transforms in GraphicsLayerCA through layers with masksToBounds().
+
+ Tests: compositing/clipping/preserve3d-flatten-assertion-nested.html
+ compositing/clipping/preserve3d-flatten-assertion.html
+
+ * css/StyleResolver.cpp:
+ (WebCore::StyleResolver::adjustRenderStyle):
+ * platform/graphics/ca/GraphicsLayerCA.cpp:
+ (WebCore::accumulatesTransform):
+
2016-04-21 Chris Dumez <cdu...@apple.com>
Element::idForStyleResolution() is a foot-gun
Modified: trunk/Source/WebCore/css/StyleResolver.cpp (199846 => 199847)
--- trunk/Source/WebCore/css/StyleResolver.cpp 2016-04-21 23:56:03 UTC (rev 199846)
+++ trunk/Source/WebCore/css/StyleResolver.cpp 2016-04-22 00:08:28 UTC (rev 199847)
@@ -975,6 +975,8 @@
// FIXME: when dropping the -webkit prefix on transform-style, we should also have opacity < 1 cause flattening.
if (style.preserves3D() && (style.overflowX() != OVISIBLE
|| style.overflowY() != OVISIBLE
+ || style.hasClip()
+ || style.clipPath()
|| style.hasFilter()
#if ENABLE(FILTERS_LEVEL_2)
|| style.hasBackdropFilter()
Modified: trunk/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp (199846 => 199847)
--- trunk/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp 2016-04-21 23:56:03 UTC (rev 199846)
+++ trunk/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp 2016-04-22 00:08:28 UTC (rev 199847)
@@ -1131,7 +1131,7 @@
static inline bool accumulatesTransform(const GraphicsLayerCA& layer)
{
- return layer.preserves3D() || (layer.parent() && layer.parent()->preserves3D());
+ return !layer.masksToBounds() && (layer.preserves3D() || (layer.parent() && layer.parent()->preserves3D()));
}
bool GraphicsLayerCA::recursiveVisibleRectChangeRequiresFlush(const TransformState& state) const
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
