[Webkit-unassigned] [Bug 140581] setting the textContent of an element in a flex-box can trigger improper clipping of redraws

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=140581

--- Comment #3 from zalan <zalan at apple.com> ---
(In reply to comment #2)
> RenderBlockFlow::layoutInlineChildren() returns with the correct repaint
> rect (repaintLogicalTop, repaintLogicalBottom) as the result of deleting
> line boxes, but later in RenderBlockFlow::layoutBlock() we intersect this
> repaint rect with the newly computed size when clipping is present.
> // Don't allow this rect to spill out of our overflow box.
> repaintRect.intersect(LayoutRect(LayoutPoint(), size()));
> So while shrinking the flow, we fail to clean up the bits that's outside of
> the current rect (unless we delete from the bottom/end of the line as then
> the repaint issued by the box-to-be-deleted takes care of the "outside"
> part.)
> I wonder if we've got a different codepath responsible to clean up.
It's a bit more complicated than that. This is specific to flexboxes.
1. in RenderFlexibleBox::layoutBlock() we call layoutFlexItems() to layout children.
2. We hit the absolute positioned (with top:0 bottom:0) RenderBlockFlow where the <img> renderers are.
3. RenderBlockFlow::layoutBlock() calls layoutInlineChildren() which comes back with proper top and bottom repaint coords (they correctly cover the change inside the flow)
4. Since this absolute positioned RenderBlockFlow() also has overflow clip, we intersect the repaint rect with the computed size().  
5 We compute the height of the flow using the parent's height (stretch to 100% with top:0 bottom:0). However, at this point the parent flexbox's height is not final yet. Intersecting the repaint rect with the updated size() results in ignoring the bottom dirty area.
6. RenderFlexibleBox calls updateLogicalHeight() and repositionLogicalHeightDependentFlexItems()
7. Another round for RenderBlockFlow::layoutBlock().
8. layoutInlineChildren() now returns with 0, 0 (top, bottom) dirty rect. (no change since the last pass)
9. Flow's height gets update properly, but since the top and bottom dirty rect == 0, we end up not repaint anything during this second pass.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150120/18620d10/attachment-0002.html>