1740757 - Filtered shapes inside nested SVG overflows outside their bounds (aren't clipped properly)

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect)

Description

[alonso.javier.torres]

Attachment: bug-firefox.svg

Steps to reproduce:

The attached SVG won't display correctly with my current Firefox versión (Linux). For comparison, it works properly on Chrome.

Actual results:

The SVG contains two nested SVG's the second one contains a path element with bounds outside its parent.

The path is drawn outside the SVG bounds. Looks like an issue when the filter overlaps another shape because if you remove the filter or the other shape the issue disappears.

Expected results:

It should be clipped by its container and only show the path part that is inside the SVG.

Comment 1

[alonso.javier.torres]

It works fine in FF 91 on Windows and FF 93 in Linux.

Comment 2

[Robert Longson [:longsonr]]

Perhaps you could determine a regression range then using mozregression

Comment 3

[alonso.javier.torres]

(In reply to Robert Longson [:longsonr] from comment #2)

Perhaps you could determine a regression range then using mozregression

I've runned mozregression I've attached the result as a screenshot. I paste the result here as well:

(Bisection progress)

Bisecting on mozilla-central [2020-11-12 - 2021-11-12]
Tested mozilla-central build: 2021-05-14 (verdict: b)
Tested mozilla-central build: 2021-02-12 (verdict: b)
Tested mozilla-central build: 2020-12-28 (verdict: b)
Tested mozilla-central build: 2020-12-05 (verdict: b)
Tested mozilla-central build: 2020-11-24 (verdict: b)
Tested mozilla-central build: 2020-11-18 (verdict: g)
Tested mozilla-central build: 2020-11-21 (verdict: b)
Tested mozilla-central build: 2020-11-20 (verdict: g)
Bisecting on mozilla-central [fd1683e5 - 6d24eff0]
Tested mozilla-central build: 8d856134 (verdict: b)
Bisecting on autoland [fd1683e5 - 98e8b23c]
Tested autoland build: 39c13de7 (verdict: g)
Tested autoland build: 0214170e (verdict: b)
Tested autoland build: 4bc0bdcd (verdict: b)
Tested autoland build: 81361995 (verdict: g)

Log View (last lines)
2021-11-12T13:02:55: INFO : Narrowed integration regression window from [39c13de7, 4bc0bdcd] (4 builds) to [81361995, 4bc0bdcd] (2 builds) (~1 steps left)
2021-11-12T13:02:55: DEBUG : Starting merge handling...
2021-11-12T13:02:55: DEBUG : Using url: https://hg.mozilla.org/integration/autoland/json-pushes?changeset=4bc0bdcd7889aab2994b4500d41e6e35216e4848&full=1
2021-11-12T13:02:56: DEBUG : Found commit message:
Backed out changeset d57553438d94 (bug 1675329) for causing bustages in nsAppShell. CLOSED TREE

2021-11-12T13:02:56: DEBUG : Did not find a branch, checking all integration branches
2021-11-12T13:02:56: INFO : The bisection is done.
2021-11-12T13:02:56: INFO : Stopped

Comment 4

[alonso.javier.torres]

Attachment: 2021-11-12-130431_1272x901_scrot.png

Comment 5

[Alice0775 White]

from comment#3
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=81361995&tochange=4bc0bdcd

Comment 6

[Alice0775 White]

I can reproduce the issue on Nightly96.0a1 Windows10 w/ WebRenfer/WebRender(software).

Comment 7

[Darkspirit]

Thanks for the report!

Gnome Xwayland, Debian Testing, Intel
It seems this bug existed for a long time, then it was fixed, then it came back.

MOZ_DISABLE_CONTENT_SANDBOX=1 mozregression --find-fix --bad 2020-01-01 --good 2021-06-01 --pref gfx.webrender.all:true -a https://bug1740757.bmoattachments.org/attachment.cgi?id=9250409

7:17.50 INFO: First good revision: c1a29b263709319c149950a118448ad084a00120
7:17.50 INFO: Last bad revision: d3b02e2c82d97b82f3b03b27bd8a8d41176ce67d
7:17.50 INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=d3b02e2c82d97b82f3b03b27bd8a8d41176ce67d&tochange=c1a29b263709319c149950a118448ad084a00120

c1a29b263709319c149950a118448ad084a00120 Matt Woodrow — Bug 1548056 - Use nsDisplayItem::Paint and DLBI to paint fallback filters instead of FrameLayerBuilder. r=jrmuizel
9849809643a6c162fb09f41d77b431b50d4b6faf Matt Woodrow — Bug 1548056 - Use nsDisplayItem::Paint for filters and transforms within SVG blobs instead of FrameLayerBuilder. r=jrmuizel

mozregression --good 2021-06-01 --bad 2021-11-12 --pref gfx.webrender.all:true -a https://bug1740757.bmoattachments.org/attachment.cgi?id=9250409

6:07.05 INFO: Last good revision: eb592f79b7982217a439f7d32da52df9a40c334a
6:07.05 INFO: First bad revision: e8a29c8f1e095884077d52166404a854fba86280
6:07.05 INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=eb592f79b7982217a439f7d32da52df9a40c334a&tochange=e8a29c8f1e095884077d52166404a854fba86280

e8a29c8f1e095884077d52166404a854fba86280 Matt Woodrow — Bug 1729236 - Remove GetPaintRect. r=jrmuizel
973c5761459d19eeead81b07246ff87ceaccd411 Matt Woodrow — Bug 1729236 - Don't use GetPaintRect for painting text. r=jrmuizel
a17c98fe397141d15219ebbcd5e38a3fa6f49f35 Matt Woodrow — Bug 1729236 - Don't use GetPaintRect for CreateWebRenderCommands. r=jrmuizel
5c4f88bd2fae678a16904f3b89db87a515522b38 Matt Woodrow — Bug 1542929 - Remove mReferenceFrame from nsDisplayItem. r=miko
49b986018657e095b022fba39a6673d0566acbca Matt Woodrow — Bug 1728251 - Remove mClip and compute it when we need it. r=miko
828ea702c5d402216c59a13b82b104022dd74b6e Matt Woodrow — Bug 1728251 - Remove FuseClipChainUpTo since its unused. r=miko
5a67bac324776c36cf661aceb588fd986cbbf1c5 Matt Woodrow — Bug 1728232 - Remove RestoreState. r=miko
afed00aaaf0f1dac94fa74b1d3e069b42bc8d7ef Matt Woodrow — Bug 1728050 - Move opacity flattening to be part of WR DL serialization. r=miko

Comment 8

[Darkspirit]

For me, the bug is only visible when opening https://bug1740757.bmoattachments.org/attachment.cgi?id=9250409 as tab, it's not visible when enlarging it in Bugzilla.

Comment 9

[alonso.javier.torres]

(In reply to Darkspirit from comment #8)

For me, the bug is only visible when opening https://bug1740757.bmoattachments.org/attachment.cgi?id=9250409 as tab, it's not visible when enlarging it in Bugzilla.

Same for me. I've checked and the rendering in bugzilla is inside a tag <img>

Comment 10

[Daniel Holbert [:dholbert]]

Attachment: reduced testcase 1

Here's a reduced testcase, with notes inside of it.

It looks like we're just failing to clip filtered elements inside of nested <svg> elements, if there's other content that we're drawing outside of the clipping rect.

Comment 11

[Daniel Holbert [:dholbert]]

Confirmed the regression range, with the new testcase (my range matches the one at end of comment 7):
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=eb592f79b7982217a439f7d32da52df9a40c334a&tochange=e8a29c8f1e095884077d52166404a854fba86280

Reclassifying as WebRender, since this seems to be a bug in WebRender (or adjacent) painting code based on this regression range.

Jeff or Miko, could you take a look here?

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Miko, do you have cycles to look at this?

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Nicolas, do you have cycles to look at this by chance?

Comment 14

[Nicolas Silva [:nical]]

Not in the short term, leaving the needinfo as a reminder.

Comment 15

[Mayank Bansal]

This works for me in the latest Nightly.
Fix range: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=89b0f422a716f208ec0e0e85aaa5ac7c0b759ee9&tochange=0a4cbd771ad2b7b71032136e2b7375e0834ef9f7

suspect : bug 1686654