Don't assert rect mapping result if impossible, and enable assert in debug build

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/PaintInvalidationState.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
 #include "core/layout/LayoutPart.h"
 #include "core/layout/LayoutView.h"
 #include "core/layout/svg/LayoutSVGModelObject.h"
 #include "core/layout/svg/LayoutSVGRoot.h"
 #include "core/layout/svg/SVGLayoutSupport.h"
 #include "core/paint/PaintLayer.h"
 
-// We can't enable this by default because saturated operations of LayoutUnit
-// don't conform commutative law for overflowing results, preventing us from
-// making fast path and slow path always return the same result.
-#define ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH (0 && ENABLE(ASSERT))
-
 namespace blink {
 
-#if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
-// Make sure that the fast path and the slow path generate the same rect.
-void assertRectsEqual(const LayoutObject& object, const LayoutBoxModelObject& ancestor, const LayoutRect& rect, const LayoutRect& slowPathRect)
-{
-    // TODO(wangxianzhu): This is for cases that a sub-frame creates a root PaintInvalidationState
-    // which doesn't inherit clip from ancestor frames.
-    // Remove the condition when we eliminate the latter case of PaintInvalidationState(const LayoutView&, ...).
-    if (object.isLayoutView())
-        return;
-
-    // We ignore ancestor clipping for FixedPosition in fast path.
-    if (object.styleRef().position() == FixedPosition)
-        return;
-
-    // TODO(crbug.com/597903): Fast path and slow path should generate equal empty rects.
-    if (rect.isEmpty() && slowPathRect.isEmpty())
-        return;
-
-    if (rect == slowPathRect)
-        return;
-
-    // Tolerate the difference between the two paths when crossing frame boundaries.
-    if (object.view() != ancestor.view()) {
-        LayoutRect inflatedRect = rect;
-        inflatedRect.inflate(1);
-        if (inflatedRect.contains(slowPathRect))
-            return;
-        LayoutRect inflatedSlowPathRect = slowPathRect;
-        inflatedSlowPathRect.inflate(1);
-        if (inflatedSlowPathRect.contains(rect))
-            return;
-    }
-
-#ifndef NDEBUG
-    WTFLogAlways("Fast path paint invalidation rect differs from slow path: %s vs %s", rect.toString().ascii().data(), slowPathRect.toString().ascii().data());
-    showLayoutTree(&object);
-#endif
-    ASSERT_NOT_REACHED();
-}
-#endif
-
 static bool supportsCachedOffsets(const LayoutObject& object)
 {
     return !object.hasTransformRelatedProperty()
         && !object.hasReflection()
         && !object.hasFilterInducingProperty()
         && !object.isLayoutFlowThread()
         && !object.isLayoutMultiColumnSpannerPlaceholder()
         && !object.styleRef().isFlippedBlocksWritingMode()
         && !(object.isLayoutBlock() && object.isSVG());
 }
 
 PaintInvalidationState::PaintInvalidationState(const LayoutView& layoutView, Vector<LayoutObject*>& pendingDelayedPaintInvalidations)
     : m_currentObject(layoutView)
     , m_forcedSubtreeInvalidationWithinContainer(false)
     , m_forcedSubtreeInvalidationRectUpdateWithinContainer(false)
     , m_clipped(false)
     , m_clippedForAbsolutePosition(false)
     , m_cachedOffsetsEnabled(true)
     , m_cachedOffsetsForAbsolutePositionEnabled(true)
     , m_paintInvalidationContainer(&layoutView.containerForPaintInvalidation())
     , m_paintInvalidationContainerForStackedContents(m_paintInvalidationContainer)
     , m_containerForAbsolutePosition(layoutView)
     , m_pendingDelayedPaintInvalidations(pendingDelayedPaintInvalidations)
     , m_enclosingSelfPaintingLayer(*layoutView.layer())
 #if ENABLE(ASSERT)
     , m_didUpdateForChildren(false)
 #endif
+#ifdef CHECK_FAST_PATH_SLOW_PATH_EQUALITY
+    , m_canCheckFastPathSlowPathEquality(layoutView == m_paintInvalidationContainer)
+#endif
 {
     if (!supportsCachedOffsets(layoutView)) {
         m_cachedOffsetsEnabled = false;
         return;
     }
 
     FloatPoint point = layoutView.localToAncestorPoint(FloatPoint(), m_paintInvalidationContainer, TraverseDocumentBoundaries | InputIsInFrameCoordinates);
     m_paintOffset = LayoutSize(point.x(), point.y());
     m_paintOffsetForAbsolutePosition = m_paintOffset;
 }
@@ skipping 12 matching lines @@
     , m_cachedOffsetsForAbsolutePositionEnabled(parentState.m_cachedOffsetsForAbsolutePositionEnabled)
     , m_paintInvalidationContainer(parentState.m_paintInvalidationContainer)
     , m_paintInvalidationContainerForStackedContents(parentState.m_paintInvalidationContainerForStackedContents)
     , m_containerForAbsolutePosition(currentObject.canContainAbsolutePositionObjects() ? currentObject : parentState.m_containerForAbsolutePosition)
     , m_svgTransform(parentState.m_svgTransform)
     , m_pendingDelayedPaintInvalidations(parentState.pendingDelayedPaintInvalidationTargets())
     , m_enclosingSelfPaintingLayer(parentState.enclosingSelfPaintingLayer(currentObject))
 #if ENABLE(ASSERT)
     , m_didUpdateForChildren(false)
 #endif
+#ifdef CHECK_FAST_PATH_SLOW_PATH_EQUALITY
+    , m_canCheckFastPathSlowPathEquality(parentState.m_canCheckFastPathSlowPathEquality)
+#endif
 {
     if (currentObject == parentState.m_currentObject) {
         // Sometimes we create a new PaintInvalidationState from parentState on the same object
         // (e.g. LayoutView, and the HorriblySlowRectMapping cases in LayoutBlock::invalidatePaintOfSubtreesIfNeeded()).
         // TODO(wangxianzhu): Avoid this for RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled().
 #if ENABLE(ASSERT)
         m_didUpdateForChildren = parentState.m_didUpdateForChildren;
 #endif
         return;
     }
@@ skipping 60 matching lines @@
             // from the original paintInvalidationContainerForStackingContents, then use this paint offset to adjust
             // m_paintOffsetForAbsolutePosition.
             updateForCurrentObject(parentState);
             m_paintOffsetForAbsolutePosition -= m_paintOffset;
             if (m_clippedForAbsolutePosition)
                 m_clipRectForAbsolutePosition.move(-m_paintOffset);
         }
 
         m_clipped = false; // Will be updated in updateForChildren().
         m_paintOffset = LayoutSize();
+#ifdef CHECK_FAST_PATH_SLOW_PATH_EQUALITY
+        m_canCheckFastPathSlowPathEquality = true;
+#endif
         return;
     }
 
     updateForCurrentObject(parentState);
 }
 
 void PaintInvalidationState::updateForCurrentObject(const PaintInvalidationState& parentState)
 {
     if (!m_cachedOffsetsEnabled)
         return;
@@ skipping 14 matching lines @@
             // is under the containing LayoutView.
             m_cachedOffsetsEnabled = false;
             return;
         }
         // Use slow path to get the offset of the fixed-position, and enable fast path for descendants.
         FloatPoint fixedOffset = m_currentObject.localToAncestorPoint(FloatPoint(), m_paintInvalidationContainer, TraverseDocumentBoundaries);
         m_paintOffset = LayoutSize(fixedOffset.x(), fixedOffset.y());
         // In the above way to get paint offset, we can't get accurate clip rect, so just assume no clip.
         // Clip on fixed-position is rare, in case that paintInvalidationContainer crosses frame boundary
         // and the LayoutView is clipped by something in owner document.
-        m_clipped = false;
+        if (m_clipped) {
+            m_clipped = false;
+#ifdef CHECK_FAST_PATH_SLOW_PATH_EQUALITY
+            m_canCheckFastPathSlowPathEquality = false;
+#endif
+        }
         return;
     }
 
     if (position == AbsolutePosition) {
         m_cachedOffsetsEnabled = m_cachedOffsetsForAbsolutePositionEnabled;
         if (!m_cachedOffsetsEnabled)
             return;
 
         m_paintOffset = m_paintOffsetForAbsolutePosition;
         m_clipped = m_clippedForAbsolutePosition;
@@ skipping 92 matching lines @@
 LayoutPoint PaintInvalidationState::computePositionFromPaintInvalidationBacking() const
 {
     ASSERT(!m_didUpdateForChildren);
 
     FloatPoint point;
     if (m_paintInvalidationContainer != &m_currentObject) {
         if (m_cachedOffsetsEnabled) {
             if (m_currentObject.isSVG() && !m_currentObject.isSVGRoot())
                 point = m_svgTransform.mapPoint(point);
             point += FloatPoint(m_paintOffset);
-#if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
+#ifdef CHECK_FAST_PATH_SLOW_PATH_EQUALITY
             // TODO(wangxianzhu): We can't enable this ASSERT for now because of crbug.com/597745.
             // ASSERT(point == slowLocalOriginToAncestorPoint(m_currentObject, m_paintInvalidationContainer, FloatPoint());
 #endif
         } else {
             point = slowLocalToAncestorPoint(m_currentObject, *m_paintInvalidationContainer, FloatPoint());
         }
     }
 
     if (m_paintInvalidationContainer->layer()->groupedMapping())
         PaintLayer::mapPointInPaintInvalidationContainerToBacking(*m_paintInvalidationContainer, point);
@@ skipping 15 matching lines @@
 
 LayoutRect PaintInvalidationState::computePaintInvalidationRectInBackingForSVG() const
 {
     LayoutRect rect;
     if (m_cachedOffsetsEnabled) {
         FloatRect svgRect = SVGLayoutSupport::localOverflowRectForPaintInvalidation(m_currentObject);
         rect = SVGLayoutSupport::transformPaintInvalidationRect(m_currentObject, m_svgTransform, svgRect);
         rect.move(m_paintOffset);
         if (m_clipped)
             rect.intersect(m_clipRect);
-#if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
+#ifdef CHECK_FAST_PATH_SLOW_PATH_EQUALITY
         LayoutRect slowPathRect = SVGLayoutSupport::clippedOverflowRectForPaintInvalidation(m_currentObject, *m_paintInvalidationContainer);
-        assertRectsEqual(m_currentObject, m_paintInvalidationContainer, rect, slowPathRect);
+        assertFastPathAndSlowPathRectsEqual(rect, slowPathRect);
 #endif
     } else {
         // TODO(wangxianzhu): Sometimes m_cachedOffsetsEnabled==false doesn't mean we can't use cached
         // m_svgTransform. We can use hybrid fast path (for SVG) and slow path (for things above the SVGRoot).
         rect = SVGLayoutSupport::clippedOverflowRectForPaintInvalidation(m_currentObject, *m_paintInvalidationContainer);
     }
 
     if (m_paintInvalidationContainer->layer()->groupedMapping())
         PaintLayer::mapRectInPaintInvalidationContainerToBacking(*m_paintInvalidationContainer, rect);
     return rect;
 }
 
 static void slowMapToVisualRectInAncestorSpace(const LayoutObject& object, const LayoutBoxModelObject& ancestor, LayoutRect& rect)
 {
     if (object.isLayoutView())
         toLayoutView(object).mapToVisualRectInAncestorSpace(&ancestor, rect, InputIsInFrameCoordinates, DefaultVisualRectFlags);
     else
         object.mapToVisualRectInAncestorSpace(&ancestor, rect);
 }
 
 void PaintInvalidationState::mapLocalRectToPaintInvalidationContainer(LayoutRect& rect) const
 {
     ASSERT(!m_didUpdateForChildren);
 
     if (m_cachedOffsetsEnabled) {
-#if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
+#ifdef CHECK_FAST_PATH_SLOW_PATH_EQUALITY
         LayoutRect slowPathRect(rect);
         slowMapToVisualRectInAncestorSpace(m_currentObject, *m_paintInvalidationContainer, slowPathRect);
 #endif
         rect.move(m_paintOffset);
         if (m_clipped)
             rect.intersect(m_clipRect);
-#if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
-        assertRectsEqual(m_currentObject, *m_paintInvalidationContainer, rect, slowPathRect);
+#ifdef CHECK_FAST_PATH_SLOW_PATH_EQUALITY
+        assertFastPathAndSlowPathRectsEqual(rect, slowPathRect);
 #endif
     } else {
         slowMapToVisualRectInAncestorSpace(m_currentObject, *m_paintInvalidationContainer, rect);
     }
 }
 
 void PaintInvalidationState::mapLocalRectToPaintInvalidationBacking(LayoutRect& rect) const
 {
     mapLocalRectToPaintInvalidationContainer(rect);
 
@@ skipping 14 matching lines @@
 }
 
 PaintLayer& PaintInvalidationState::enclosingSelfPaintingLayer(const LayoutObject& layoutObject) const
 {
     if (layoutObject.hasLayer() && toLayoutBoxModelObject(layoutObject).hasSelfPaintingLayer())
         return *toLayoutBoxModelObject(layoutObject).layer();
 
     return m_enclosingSelfPaintingLayer;
 }
 
+#ifdef CHECK_FAST_PATH_SLOW_PATH_EQUALITY
+
+static bool mayHaveBeenSaturated(LayoutUnit value)
+{
+    // This is not accurate, just to avoid too big values.
+    return value.abs() >= LayoutUnit::max() / 2;
+}
+
+static bool mayHaveBeenSaturated(const LayoutRect& rect)
+{
+    return mayHaveBeenSaturated(rect.x()) || mayHaveBeenSaturated(rect.y()) || mayHaveBeenSaturated(rect.width()) || mayHaveBeenSaturated(rect.height());
+}
+
+void PaintInvalidationState::assertFastPathAndSlowPathRectsEqual(const LayoutRect& fastPathRect, const LayoutRect& slowPathRect) const
+{
+    if (!m_canCheckFastPathSlowPathEquality)
+        return;
+
+    // TODO(crbug.com/597903): Fast path and slow path should generate equal empty rects.
+    if (fastPathRect.isEmpty() && slowPathRect.isEmpty())
+        return;
+
+    if (fastPathRect == slowPathRect)
+        return;
+
+    // LayoutUnit uses saturated arithmetic operations. If any interim or final result is saturated,
+    // the same operations in different order produce different results. Don't compare results
+    // if any of them may have been saturated.
+    if (mayHaveBeenSaturated(fastPathRect) || mayHaveBeenSaturated(slowPathRect))
+        return;
+
+    // Tolerate the difference between the two paths when crossing frame boundaries.
+    if (m_currentObject.view() != m_paintInvalidationContainer->view()) {
+        LayoutRect inflatedFastPathRect = fastPathRect;
+        inflatedFastPathRect.inflate(1);
+        if (inflatedFastPathRect.contains(slowPathRect))
+            return;
+        LayoutRect inflatedSlowPathRect = slowPathRect;
+        inflatedSlowPathRect.inflate(1);
+        if (inflatedSlowPathRect.contains(fastPathRect))
+            return;
+    }
+
+    WTFLogAlways("Fast path paint invalidation rect differs from slow path: fast: %s vs slow: %s",
+        fastPathRect.toString().ascii().data(), slowPathRect.toString().ascii().data());
+    showLayoutTree(&m_currentObject);
+
+    ASSERT_NOT_REACHED();
+}
+
+#endif // CHECK_FAST_PATH_SLOW_PATH_EQUALITY
+
 } // namespace blink