[Webkit-unassigned] [Bug 234315] REGRESSION (r286982): ASSERTION FAILED: clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType]

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=234315

--- Comment #3 from cathiechen <cathiechen at igalia.com> ---
Created attachment 447933

  --> https://bugs.webkit.org/attachment.cgi?id=447933&action=review

WIP-patch

Looks like it hits this assert.
ASSERT(clipRectsContext.rootLayer == m_clipRectsCache->m_clipRectsRoot[clipRectsType]);

IIUC, `m_clipRectsRoot` of ClipRectsCache is set while `updateLayerPositions()` which happens after layout.
And  `clipRectsContext.rootLayer` comes from `paintInfo.rootLayer`.
Looks like the rootLayer is changed in RenderLayer::paintLayerByApplyingTransform(see [1]).
Also happens in RenderLayer::hitTestLayerByApplyingTransform(see [2]).

Then the assert doesn't pass.

Regarding the approach, I tried to update `m_clipRectsRoot` of ClipRectsCache, it seems not work, for there are other layers don't has transform.
So maybe we shouldn't let the transform layers use the clipRects in `m_clipRectsRoot`, i.e, use TemporaryClipRects instead. The WIP patch is attached, not sure if this makes sense or not?

[1] https://webkit-search.igalia.com/webkit/source/Source/WebCore/rendering/RenderLayer.cpp#3495
[2] https://webkit-search.igalia.com/webkit/source/Source/WebCore/rendering/RenderLayer.cpp#4333

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20211224/1435c0d3/attachment.htm>