Testcase: data:text/html,<div style="writing-mode:vertical-lr">Hello <b>world Excerpt from the resulting frame tree: Block(div)(0)@125e1be78 {0,0,0,0} [state=0002120000100601] [content=125ca9660] [sc=125e1bb68]< line 125e1c438: count=2 state=inline,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x100] {0,0,1152,4769} vis-overflow=0,-179,2524,4948 scr-overflow=0,0,1152,4769 < Text(0)"Hello "@125e1c2e0 next=125e1c350 {96,0,960,2371} vis-overflow=-30,-179,2191,2550 scr-overflow=0,0,960,2371 [state=00010000b0200000] [content=11b36ae00] [sc=125e1bc28:-moz-non-element] [run=11b9ee3a0][0,6,T] Inline(b)(1)@125e1c350 {96,2371,960,2398} vis-overflow=-30,-169,2458,2567 scr-overflow=0,0,960,2398 [state=0002100000000200] [content=11b36af20] [sc=125e1c0d0]< Text(0)"world"@125e1c3c8 {0,0,960,2398} vis-overflow=-30,-169,2458,2567 [state=00010000a0400000] [content=11b36afb0] [sc=125e1c1e8:-moz-non-element] [run=11b9ee4c0][0,5,T] > > > Note how the vis-overflow rects of the two Text frames (in physical coordinates) are approximately as wide as they are tall, which is clearly incorrect; they should be substantially narrower.

This occurs because of a vertical/horizontal coordinate system mixup: when we measure textruns, we get back metrics that are "line-relative", where vertical runs use swapped x and y coordinates; but then we fail to account for that swap when merging the coordinates into the vis-overflow rect. Therefore, we'll often end up repainting much more of the screen than necessary; and in some cases, we can end up clipping glyphs that should be drawn, although this is less common. Example (on OS X): data:text/html,<div contenteditable style="writing-mode:vertical-lr; font-family:zapfino; margin:10px">k</div> Note the clipped ascender of the Zapfino "k" glyph. Now place the cursor after the "k", and slowly type three periods; note how as the text is extended vertically, the ascender (which projects to the right) gradually gets drawn. This is because the addition of the periods (at the bottom) results in extending the vis-overflow area (rightwards), as a result of this bug.

Comment on attachment 8504005 [details] [diff] [review] Convert textrun metrics to physical coordinates before merging with visual-overflow region. Review of attachment 8504005 [details] [diff] [review]: ----------------------------------------------------------------- LGTM

sorry had to back this out for bustage like https://treeherder.mozilla.org/ui/logviewer.html#?job_id=3042851&repo=mozilla-inbound

Argh, sorry about that. Fixed, test-built, and re-landed: https://hg.mozilla.org/integration/mozilla-inbound/rev/916675800e05