1178575 - In certain cases, box-shadow is drawn twice

Status: RESOLVED FIXED

(Core :: Web Painting, defect)

Description

[Chris Morgan]

Attachment: Reduced test case demonstrating the bug on body hover

In a certain fairly obscure (but realistic) set of circumstances, an element’s box-shadow is drawn twice, which for a semi-transparent box-shadow has the effect of making it twice as opaque as it should be.

The issue appears to require these conditions:

- The element must be contained in something with `overflow: hidden`;
- The element must have `position: absolute` and it must span the element with `overflow: hidden` (the easiest way is typically `left: 0; right: 0`);
- The element’s `height` CSS property must be changed from something small to something large (the precise magnitudes of the small and large seem to vary on the box-shadow spread radius);
- The element must have a semi-transparent box-shadow with no blur but with spread;

This happened to me in real and fairly complex code that I was writing, but it reduced nicely to the attached test case.

Reproduced on both Arch Linux (64-bit) and Mac OS X.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

nsDisplayBoxShadowOuter::Paint calls ComputeDisjointRectangles, which produces two disjoint rectangles.  This code comes from https://hg.mozilla.org/mozilla-central/rev/1a0f2d658a49 .

(Prior to https://hg.mozilla.org/mozilla-central/rev/fdbe3aa72cdb this did a clip.)

Then it uses each as the aDirtyRect to a call to nsCSSRendering::PaintBoxShadowOuter, which in turn calls nsContextBoxBlur::BlurRectangle, which in the non-blur codepath does a FillRect.  This path completely ignores aDirtyRect.

The actually regression, though, came in this range (from Linux nightlies):
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4b6d63b05a0a&tochange=2f8af55d6e9a
but I'm not sure why.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(In reply to David Baron [:dbaron] ⏰UTC-7 from comment #1)
> nsDisplayBoxShadowOuter::Paint calls ComputeDisjointRectangles, which
> produces two disjoint rectangles.  This code comes from
> https://hg.mozilla.org/mozilla-central/rev/1a0f2d658a49 .
> 
> (Prior to https://hg.mozilla.org/mozilla-central/rev/fdbe3aa72cdb this did a
> clip.)

To be clear:  it looks like these two revisions are, when combined, incorrect, although I don't know why the bug didn't show up until a week after the second one.

Comment 3

[Mats Palmgren (inactive)]

Attachment: Same test, but only overflowing on the left side (bug does not occur)

FWIW, it seems the bug only occurs when overflow occurs on both
the left and right sides, not when overflowing on just one side.

Comment 4

[Mats Palmgren (inactive)]

Attachment: 1008301-backout

(In reply to David Baron [:dbaron] ⏰UTC-7 (busy Aug. 8-Aug. 30) from comment #1)
> (Prior to fdbe3aa72cdb this did a clip.)

The Clip call was moved inside PaintBoxShadowOuter instead, but you're right
that the aDirtyRect part fell out.

> The actually regression, though, came in this range (from Linux nightlies):
> https://hg.mozilla.org/mozilla-central/
> pushloghtml?fromchange=4b6d63b05a0a&tochange=2f8af55d6e9a
> but I'm not sure why.

Backing out bug 1008301 in a trunk build makes the problem go away.
Here's a backout patch for doing that if anyone wants to investigate why.

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I was hoping you'd be able to fix this.

Comment 6

[Mats Palmgren (inactive)]

Attachment: fix

Like dbaron, I don't understand why the bug only manifests after the changes
in bug 1008301.  The fix seems simple enough though.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=2bb1770827e5
(looks green to me)

Comment 7

[Mats Palmgren (inactive)]

Attachment: tests

Comment 8

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/786625a84d87
https://hg.mozilla.org/integration/mozilla-inbound/rev/927e481324f9

Comment 9

[Mats Palmgren (inactive)]

ComputeDisjointRectangles says it's only "approximate", so I wonder if this bug
can still occur if it generates two rectangles that overlap?

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/786625a84d87
https://hg.mozilla.org/mozilla-central/rev/927e481324f9