1514653 - Media files display incorrectly on groupme.com since Firefox 63

Status: RESOLVED FIXED

(Core :: Web Painting, defect, P1)

Description

[bgstandaert]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:65.0) Gecko/20100101 Firefox/65.0

Steps to reproduce:

1. Go to https://groupme.com/ (14 million visits/month according to SimilarWeb) and sign up for an account.
2. Create a new chat, and have someone send you a picture.
3. Open the conversation, and click on the picture to enlarge it.


Actual results:

The picture should display correctly, as it does in other browsers.


Expected results:

There are artifacts around the picture, and part of the picture is cut off (see attached screenshots). Doing anything to trigger a reflow (resizing the browser window, etc.) makes the picture display correctly again.

Mozregression result: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=85f1c6e5ddac7792b327c05996f8bf27ed728d72&tochange=92bd3b2178623a036ea91990aa5570e039890ff4

Comment 1

[bgstandaert]

Attachment: incorrect.jpg

actual rendering, red squares are where personal information was redacted

Comment 2

[bgstandaert]

Attachment: correct.jpg

expected rendering

Comment 3

[Pascal Chevrel:pascalc]

Thanks for the details report!
Myko, it seems your patch in Bug 1462672 caused this regression, could you have a look please? Thanks

Comment 4

[Miko Mynttinen]

Thank you for the report, I managed to reproduce this with Nightly.

Comment 5

[Miko Mynttinen]

This was a very tricky bug to find. Simplified version of the display list:

nsDisplayWrapList layer=a ref=x
  nsDisplayTransform layer=a ref=x

The bug is caused by parent item of the transform changing along with a reference frame.

nsDisplayTransform old-layer=none ref=y
  nsDisplayTransform old-layer=a ref=z

When this updated display list is processed, we flatten both the parent and child transform items, and select the same PaintedLayerData for them. Since the parent transform item is new, it does not have an old layer to recycle, so the selected PaintedLayerData will not get a layer set.

The problem arises when the child transform item recycles its old layer with its own referenceFrame, which instead should be the one that the parent transform item is using.

Comment 6

[Miko Mynttinen]

Attachment: Bug 1514653 - Use the reference frame of the first flattened effect when recycling the layer

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f722c4dbd4cc
Use the reference frame of the first flattened effect when recycling the layer r=mattwoodrow

Comment 8

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/f722c4dbd4cc

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Any chance we could create an automated test for this regression?

Comment 10

[Miko Mynttinen]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #9)

Any chance we could create an automated test for this regression?

Yes, I managed to create a reftest for this.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6cee5c4042e9
Add a reftest r=me

Comment 12

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/6cee5c4042e9