Bug 1870415. In nsCanvasFrame::BuildDisplayList, only capture background items we create in our blend container item instead of any items that might be in the display list already. r=mstange,layout-reviewers,emilio

When we call nsCanvasFrame::BuildDisplayList from nsHTMLScrollFrame::BuildDisplayList there is already a compositor hit test item in it, created here https://searchfox.org/mozilla-central/rev/ff08e36e1f368bd193b54f569dbd79105b50f9a0/layout/generic/nsGfxScrollFrame.cpp#4146

If we create a blend container item in nsCanvasFrame::BuildDisplayList it puts everything that might already exist in the display list inside the blend container item. It should only do this for the background items that we just created as this is for background blend mode, we are only blending within the background of this frame.

In the fuzz testcase we then have a partial display list build that visits the root scroll frame (because a scroll bar is dirty), so it builds the compositor hit test item for the canvas frame (the child of the scroll frame), but canvas frame is not modified, so we don't descend into it, and we don't call nsCanvasFrame::BuildDisplayList, so the compositor hit test item does not get wrapped in the blend container, and thus it has moved in the display list without being marked modified.

Differential Revision: https://phabricator.services.mozilla.com/D209511
This commit is contained in:
Timothy Nikkel 2024-05-06 21:11:33 +00:00
Родитель 5230c18c56
Коммит 12991c6b74
4 изменённых файлов: 60 добавлений и 7 удалений

Просмотреть файл

@ -546,6 +546,8 @@ void nsCanvasFrame::BuildDisplayList(nsDisplayListBuilder* aBuilder,
layers.mImageCount > 0 &&
layers.mLayers[0].mAttachment == StyleImageLayerAttachment::Fixed;
nsDisplayList list(aBuilder);
if (!hasFixedBottomLayer || needBlendContainer) {
// Put a scrolled background color item in place, at the bottom of the
// list. The color of this item will be filled in during
@ -557,20 +559,18 @@ void nsCanvasFrame::BuildDisplayList(nsDisplayListBuilder* aBuilder,
// interleaving the two with a scrolled background color.
// PresShell::AddCanvasBackgroundColorItem makes sure there always is a
// non-scrolled background color item at the bottom.
aLists.BorderBackground()->AppendNewToTop<nsDisplayCanvasBackgroundColor>(
aBuilder, this);
list.AppendNewToTop<nsDisplayCanvasBackgroundColor>(aBuilder, this);
}
aLists.BorderBackground()->AppendToTop(&layerItems);
list.AppendToTop(&layerItems);
if (needBlendContainer) {
const ActiveScrolledRoot* containerASR = contASRTracker.GetContainerASR();
DisplayListClipState::AutoSaveRestore blendContainerClip(aBuilder);
aLists.BorderBackground()->AppendToTop(
nsDisplayBlendContainer::CreateForBackgroundBlendMode(
aBuilder, this, nullptr, aLists.BorderBackground(),
containerASR));
list.AppendToTop(nsDisplayBlendContainer::CreateForBackgroundBlendMode(
aBuilder, this, nullptr, &list, containerASR));
}
aLists.BorderBackground()->AppendToTop(&list);
}
for (nsIFrame* kid : PrincipalChildList()) {

Просмотреть файл

@ -0,0 +1,35 @@
<!DOCTYPE html>
<html class="reftest-wait" >
<style>
HTML {
border: lch(53% 16 none) solid 472288419.0851412mm;
background-blend-mode: difference
}
* {
overflow-y: hidden;
position: sticky;
content-visibility: auto;
background: url(#x) local, scroll repeat-x bottom / contain, left 3% center / contain scroll padding-box, image-set('\E0FAEt\1BA3F\E0379o8' type('c\1D242+\6F0\A8E6**=\D\A\11D5D\1F9D4*\A0\FFF9 2\1F500\6F9\26F1C\2F220 0\D\1FE4C\2064*|\301\62DC\1DD1\101FD 3\643X\E00E6\E0998\2B4C7Y\6F0+*=\23DD6 A>\1615A\101FD\E0C32\1DE4\2F51D\A34A\1D908\1D244\1F9FB*"\135F-=%Z\1D172\1BF1C\C7D\A16B\669\FFFF\A21F\161BF\E0E63\3099\1BBDB\1924\E006C 4\20F9D-\101FD\E3F7\D\3099\2F97E\B>>=5\669\2998A\E0A33\E0450\1D1AC\2FDC2\2FE9E\D\1F973\E0918>\E0493\346\209BC\1D244 c4\1F469\669\E0563\D\Al3\2027\66A') 249dppx, '\E0E1B\E0500\2CC7\E020A+\FDDE\66A 0\A 5\200E\2FD7A/*\1F82 91\2F69F\D\1A7F\FE20(\D-\2F9B0\202A,\3099\FFF9\2FFEA 99G\FE22\11A03 e\16D58]7\1B7D8y\ED25\E08AB\D\A\7F2\235FE\1DBB1\3000\1B71\2029\E08A1vH|=\B751\D\0\66A' type('\23A\2F300\BCC\B48E\1D187 7\E0969\98D3\BBC5\133DF?[\2F36E\1F252\E04CE>>=\2F94D.\660\1D243\E029A 3\27048L\2BF98\2FF8B\7F1\66A\1D168 9\2826\101FD\390\1B07D 29\669\7E5DZ\2029\6F9\6F0\11F0D\27DA2\2F7EB\29A96\E05A5sA\D;\253CB\660\166D6\E0C9C*=\2F046\A682\2044\660o\296A9p\2011{\202D\202F\9\2F8BD C\\#\2A9A7\645') 75dpcm, '\301\4430\301\2F40D\1D943\16DFC 8R\12ED6\1FC45\2426\2FEA8 0<<=\29E7D\2AC8E\D\2028\66A\1D244\1125A\16FE7\D\D\16ED4\66B\1D0BA|=\FB2C\E0C77\BF-\2F93B\23A\A\D^=s\F6D5\E02EB\E008D\36A\0\\\1B885\205F/=\E0FD5\3000#8]n\6F9s\2F9B7\1A7F\B^\1D574!U4\2F645\E0A65\2060B;\FDFA\D>>=\1648A\D3EC\24A09\E05AE\E02FF\A0\E078E{\E0135\2FB3F\1D16E f\1D1AA\4FFB\3A7A\16943\A\D\E032B' 11dppx type('\489\5932\E0A6B\6F9\1F7A0\66A\1F182\205F\D\A\7F3\1DD7\16110\1D11B\1BADC\72E5\12CDB\E034E\25E85\8\669\AD\3000 9')), border-box repeat-x;
rotate: 2116778118.5570207grad 32 20208 64
}
</style>
<script>
window.addEventListener("load", () => {
let a = document.createElementNS("http://www.w3.org/1999/xhtml", "form")
document.documentElement.appendChild(a)
let b = document.createElementNS("http://www.w3.org/1999/xhtml", "p")
let c = document.createElementNS("http://www.w3.org/1999/xhtml", "span")
let d = document.createElementNS("http://www.w3.org/1999/xhtml", "bdo")
d.contentEditable = true
d.setAttribute("autofocus", true)
c.appendChild(d)
b.appendChild(c)
a.appendChild(b)
setTimeout(finish, 1000);
});
function finish() {
document.documentElement.className = "";
}
</script>
</html>

Просмотреть файл

@ -32,3 +32,4 @@ load 1763006-1.html
load 1819957-1.html
load 1851726-1.html
pref(image.testing.decode-sync.enabled,false) load 1862277-1.html
needs-focus pref(ui.caretBlinkTime,200) pref(image.testing.decode-sync.enabled,false) asserts(0-2) load 1870415-1.html

Просмотреть файл

@ -0,0 +1,17 @@
<style>
* {
position: sticky;
border-left: double 488200679.54Q hsla(-39 5% 68% / 7%) !important;
box-shadow: 172vmax 60991vmax 32in 106cm hsl(-57532411.87deg, 70%, 54%);
background-blend-mode: overlay;
background: url(data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=) local content-box space space 0em / 15438983.37cm auto;
}
</style>
<script>
window.addEventListener("load", () => {
let a = document.createElementNS("http://www.w3.org/1998/Math/MathML", "math")
a.setAttribute("href", "x")
a.autofocus = true
document.documentElement.appendChild(a)
})
</script>