Closed Bug 1544451 Opened 5 years ago Closed 3 years ago

Hit-testing produces incorrect result with nonrectangular SVG over iframe element (non-webrender)


(Core :: Panning and Zooming, defect, P3)






(Reporter: kats, Unassigned, NeedInfo)


(Blocks 1 open bug)



(2 files)

+++ This bug was initially created as a clone of Bug #1543482 +++


  • load attached file
  • move mouse the iframe and scroll it to activate the scrollframe
  • move mouse to the part of the green circle sitting on top of the iframe
  • scroll with wheel/trackpad


  • root document will scroll


  • iframe scrolls

This only happens with WR off

Here's another testcase which is more "normal" in that the SVG doesn't have pointer-events properties. So the entire SVG bounding box should scroll the root document. Instead only the circle's bounding box scrolls the root document. Chrome handles this correctly, we do not (with WR on or off).

This second case (from comment 3) is generating a display list that I'm having a hard time dealing with. Here's the display list:

On line 46 we see the transform item has a visible rect of 400x400 CSS pixels, which corresponds to the size of the <svg> element, and that's fine. But then the SVGWrapper item below it gets a visible rect of 300x300, and the hitTestArea on the CompositorHitTestInfo item is completely empty. The frame for the SVG element seems to have an empty mRect, and a 300x300 visual overflow rect, which explains what I'm seeing in the display list. But I need to extract the 400x400 rect and use that as the hitTestArea. Matt, do you know what is the correct way of getting that rect? I think what I need here is to modify the code here to get the 400x400 rect instead of using GetSize() and getting a 0x0 rect.

Flags: needinfo?(matt.woodrow)

My reading of that display list is that we're getting a hit test info item created for the SVGOuterSVGAnonChild, which is 0 sized. We don't appear to have a hit test item for the SVGOuterSVG (which almost certainly is not 0 sized).

I don't know why the SVGOuterSVGAnonChild has an empty rect, maybe jwatt knows?

I also don't know why we're not getting hit test info for the SVGOuterSVG, since it seems like that would be sufficient.

Using the visual overflow rect is generally not what we want for hit testing, since it includes the area of our descendants, and painting effects (like box-shadows etc).

Flags: needinfo?(matt.woodrow) → needinfo?(jwatt)

Dropping stale needinfo. At some point I might look into why we're not getting hit test info for the SVGOuterSVG.

Flags: needinfo?(jwatt)

I'm going to split this into two bugs, since the test case from comment 1 only affects non-WR and the testcase from comment 3 affects both WR and non-WR. Having them both here makes things more confusing. This bug will track the original issue from comment 1. I'm also unassigning it as it's lower priority and I'm not actively working on it.

Assignee: kats → nobody
Depends on: fixed-by-webrender
Summary: Hit-testing produces incorrect result with nonrectangular SVG over iframe element → Hit-testing produces incorrect result with nonrectangular SVG over iframe element (non-webrender)

By using mozregression, I confirmed this issue has been solved by bug 1534549.

Kats, can you please do double-check it's correct?

(I am going to reuse this bug to add at least one cross-origin iframe case)

Depends on: 1534549
Flags: needinfo?(kats)

I didn't verify the exact fix range but yes, this bug does seem to be fixed in the latest nightly, and it seems plausible that bug 1534549 would have fixed it.

Flags: needinfo?(kats)

NI to myself to write automated tests for this.

Flags: needinfo?(hikezoe.birchill)
Closed: 3 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.