From 39b5581175c9aa77c99791c2e492fe1312bff98d Mon Sep 17 00:00:00 2001
From: Botond Ballo <botond@mozilla.com>
Date: Thu, 26 Aug 2021 04:39:49 +0000
Subject: [PATCH] Bug 1685146 - Avoid emitting a deferred transform at the
 wrong level of the WebRenderLayerScrollData tree. r=tnikkel

Since WebRenderLayerScrollData nodes are emitted on the way out
of the recursion over the display list, we need to be careful
that a deferred transform doesn't end up on a deeper node than
it should be.

Differential Revision: https://phabricator.services.mozilla.com/D123397
---
 gfx/layers/wr/WebRenderCommandBuilder.cpp | 17 +++++++++++++++--
 layout/base/crashtests/1685146.html       | 17 +++++++++++++++++
 layout/base/crashtests/crashtests.list    |  1 +
 3 files changed, 33 insertions(+), 2 deletions(-)
 create mode 100644 layout/base/crashtests/1685146.html

diff --git a/gfx/layers/wr/WebRenderCommandBuilder.cpp b/gfx/layers/wr/WebRenderCommandBuilder.cpp
index 30c62961cba8..1453e3f937f8 100644
--- a/gfx/layers/wr/WebRenderCommandBuilder.cpp
+++ b/gfx/layers/wr/WebRenderCommandBuilder.cpp
@@ -1835,11 +1835,23 @@ void WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(
         ScrollableLayerGuid::ViewID deferredId =
             ScrollableLayerGuid::NULL_SCROLL_ID;
         bool transformShouldGetOwnLayer = false;
+        if (deferred) {
+          // It's possible the transform's ASR is not only an ancestor of
+          // the item's ASR, but an ancestor of stopAtAsr. In such cases,
+          // don't use the transform at all at this level (it would be
+          // scrolled by stopAtAsr which is incorrect). The transform will
+          // instead be emitted as part of the ancestor WebRenderLayerScrollData
+          // node (the one with stopAtAsr as its item ASR), or one of its
+          // ancetors in turn.
+          if (ActiveScrolledRoot::IsProperAncestor(
+                  deferred->GetActiveScrolledRoot(), stopAtAsr)) {
+            deferred = nullptr;
+          }
+        }
         if (deferred) {
           if (const auto* asr = deferred->GetActiveScrolledRoot()) {
             deferredId = asr->GetViewId();
           }
-
           if (deferred->GetActiveScrolledRoot() !=
               item->GetActiveScrolledRoot()) {
             transformShouldGetOwnLayer = true;
@@ -1884,7 +1896,8 @@ void WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(
           mLayerScrollData.emplace_back();
           mLayerScrollData.back().Initialize(
               mManager->GetScrollData(), item, descendants, stopAtAsr,
-              aSc.GetDeferredTransformMatrix(), deferredId);
+              deferred ? aSc.GetDeferredTransformMatrix() : Nothing(),
+              deferredId);
         }
       }
     }
diff --git a/layout/base/crashtests/1685146.html b/layout/base/crashtests/1685146.html
new file mode 100644
index 000000000000..e6804f07dc9a
--- /dev/null
+++ b/layout/base/crashtests/1685146.html
@@ -0,0 +1,17 @@
+<style>
+.a {
+  clip-path: url(#x);
+  -webkit-filter: grayscale(0);
+  border-right-style: dashed;
+}
+* {
+  outline-style: solid;
+}
+.b {
+  translate: 0px 0px;
+  overflow-y: scroll;
+}
+</style>
+<marquee height="0" class="b">
+<ins class="a">
+
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index df657dd26f24..55bfc200a48a 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -556,6 +556,7 @@ load 1599532.html
 pref(layout.accessiblecaret.enabled,true) load 1606492.html
 load 1676301-1.html
 pref(apz.mvm.force-enabled,false) pref(dom.meta-viewport.enabled,false) pref(apz.allow_zooming,false) pref(layout.dynamic-toolbar-max-height,100) load 1689371.html
+load 1685146.html
 load 1689912.html
 load 1690163.html
 load 1723200.html