[Webkit-unassigned] [Bug 138737] New: Painting in selection-only black-text-only mode incorrectly includes RenderReplaced background color

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=138737

            Bug ID: 138737
           Summary: Painting in selection-only black-text-only mode
                    incorrectly includes RenderReplaced background color
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: thorton at apple.com

Created attachment 241575
  --> https://bugs.webkit.org/attachment.cgi?id=241575&action=review
repro case

Steps to Reproduce:

1. Open the attached repro case in Safari.
2. Cmd-F, "something"
3. Cmd-G. Repeat.

Expected:

The text indicator for the "something" over the <img> and the "something" over the <div> should both have a flat yellow background.

Actual:

The text indicator for the "something" over the <img> includes the red background from the <img>!
The text indicator for the "something" over the <div> correctly does not paint the <div>'s blue background.

Notes:

Somehow we're getting into background painting when we ought not.
Here's a fragment of the stack near where things go wrong, I'm just not sure exactly where/how to cut it off:

WebCore::GraphicsContext::fillRect(WebCore::FloatRect const&, WebCore::Color const&, WebCore::ColorSpace)
WebCore::RenderBoxModelObject::paintFillLayerExtended(WebCore::PaintInfo const&, WebCore::Color const&, WebCore::FillLayer const*, WebCore::LayoutRect const&, WebCore::BackgroundBleedAvoidance, WebCore::InlineFlowBox*, WebCore::LayoutSize const&, WebCore::CompositeOperator, WebCore::RenderElement*, WebCore::BaseBackgroundColorUsage)
WebCore::RenderBox::paintFillLayer(WebCore::PaintInfo const&, WebCore::Color const&, WebCore::FillLayer const*, WebCore::LayoutRect const&, WebCore::BackgroundBleedAvoidance, WebCore::CompositeOperator, WebCore::RenderElement*, WebCore::BaseBackgroundColorUsage)
WebCore::RenderBox::paintFillLayers(WebCore::PaintInfo const&, WebCore::Color const&, WebCore::FillLayer const*, WebCore::LayoutRect const&, WebCore::BackgroundBleedAvoidance, WebCore::CompositeOperator, WebCore::RenderElement*)
WebCore::RenderBox::paintBackground(WebCore::PaintInfo const&, WebCore::LayoutRect const&, WebCore::BackgroundBleedAvoidance)
WebCore::RenderBox::paintBoxDecorations(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
WebCore::RenderReplaced::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
WebCore::RenderLayer::paintForegroundForFragmentsWithPhase(WebCore::PaintPhase, WTF::Vector<WebCore::LayerFragment, 1ul, WTF::CrashOnOverflow> const&, WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int, WebCore::RenderObject*)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20141114/97fd2c97/attachment-0002.html>