From cd1b8be760040aeaa4ad11783bdcf550947920bd Mon Sep 17 00:00:00 2001
From: Stefan Zager <szager@chromium.org>
Date: Fri, 20 Feb 2026 13:22:41 -0800
Subject: [PATCH] Fix equality operator for blink::ReferenceFilterOp

Filter operations are created during style recalc, but some of them
(specifically, box-reflect and reference filters) need layout
information to compute their visual overflow extent. For box-reflect,
this is handled by always creating the filter operation ad hoc when
requested[1], presumably after pre-paint has generated the necessary
geometry information. For reference filters, this is handled by
annotating the style-generated ReferenceFilterOp with its fully resolved
compositor filter during pre-paint[2].

It can happen that a ReferenceFilterOp is re-created during style
recalc, even when the operation has not changed. When this happens, the
style diff passed to StyleDidChange() won't indicate that filters have
changed, because the equality comparison for ReferenceFilterOp doesn't
check whether the resolved compositor filters match. If nothing else in
the style diff causes the element to be marked for paint property
update, it will skip the building of compositor filters during
pre-paint, and the ReferenceFilterOp will not get annotated with its
resolved compositor filter. This doesn't break rendering, because the
EffectPaintPropertyNode will continue to point to the
previously-computed compositor filter. However, it *does* break hit
testing of visual overflow, which relies on the style-created
FilterReferenceOp being annotated with the compositor filter[3].

This CL changes the equality comparison for ReferenceFilterOp so that it
considers the annotated compositor filter. A pointer comparison is
sufficient; for a newly-created ReferenceFilterOp it will always be
`nullptr` and should force paint property update.

[1]https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/paint/paint_layer.cc;drc=d209eefee6037bd0905e43f88570fda8edab89a1;l=2397

[2]https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/paint/filter_effect_builder.cc;drc=3bbce24997c008ef45d4253542ec7f0a5a97e571;l=402

[3]https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/style/filter_operation.cc;drc=d209eefee6037bd0905e43f88570fda8edab89a1;l=46

Bug: 430198264
Change-Id: I6f3215a603a6ed831431635c37d865216d0bb333
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7597074
Commit-Queue: Stefan Zager <szager@chromium.org>
Reviewed-by: Philip Rogers <pdr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1588040}
---

diff --git a/third_party/blink/renderer/core/layout/hit_testing_test.cc b/third_party/blink/renderer/core/layout/hit_testing_test.cc
index 1699283..36e44fb 100644
--- a/third_party/blink/renderer/core/layout/hit_testing_test.cc
+++ b/third_party/blink/renderer/core/layout/hit_testing_test.cc
@@ -274,4 +274,40 @@
             HitTest(PhysicalOffset(5, 5)));
 }
 
+TEST_F(HitTestingTest, ReferenceFilter) {
+  SetBodyInnerHTML(R"HTML(
+<style>
+  #target {
+    position:absolute;
+    top:100px;
+    left:100px;
+    width:100px;
+    height:100px;
+    background-color:blue;
+    filter:url(#displace);
+  }
+</style>
+<div id="target"></div>
+<svg width="100" height="100" viewBox="0 0 100 100">
+  <filter id="displace">
+      <feFlood />
+      <feDisplacementMap
+        scale="250"
+        xChannelSelector="R"
+        yChannelSelector="G" />
+  </filter>
+</svg>
+  )HTML");
+
+  Element* target = GetElementById("target");
+  LayoutBox* box = To<LayoutBox>(target->GetLayoutObject());
+  EXPECT_EQ(box->VisualOverflowRectIncludingFilters(),
+            PhysicalRect(-10, -10, 120, 120));
+
+  target->SetInlineStyleProperty(CSSPropertyID::kOpacity, "1");
+  UpdateAllLifecyclePhasesForTest();
+  EXPECT_EQ(box->VisualOverflowRectIncludingFilters(),
+            PhysicalRect(-10, -10, 120, 120));
+}
+
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/style/filter_operation.cc b/third_party/blink/renderer/core/style/filter_operation.cc
index 3bfbf65c..b8a312e 100644
--- a/third_party/blink/renderer/core/style/filter_operation.cc
+++ b/third_party/blink/renderer/core/style/filter_operation.cc
@@ -71,7 +71,8 @@
 bool ReferenceFilterOperation::IsEqualAssumingSameType(
     const FilterOperation& o) const {
   const auto& other = To<ReferenceFilterOperation>(o);
-  return url_ == other.url_ && resource_ == other.resource_;
+  return url_ == other.url_ && resource_ == other.resource_ &&
+         filter_.Get() == other.filter_.Get();
 }
 
 gfx::RectF BlurFilterOperation::MapRect(const gfx::RectF& rect) const {

diff --git a/third_party/blink/renderer/core/layout/hit_testing_test.cc b/third_party/blink/renderer/core/layout/hit_testing_test.cc
index 1699283..36e44fb 100644
--- a/third_party/blink/renderer/core/layout/hit_testing_test.cc
+++ b/third_party/blink/renderer/core/layout/hit_testing_test.cc
@@ -274,4 +274,40 @@
             HitTest(PhysicalOffset(5, 5)));
 }
 
+TEST_F(HitTestingTest, ReferenceFilter) {
+  SetBodyInnerHTML(R"HTML(
+<style>
+  #target {
+    position:absolute;
+    top:100px;
+    left:100px;
+    width:100px;
+    height:100px;
+    background-color:blue;
+    filter:url(#displace);
+  }
+</style>
+<div id="target"></div>
+<svg width="100" height="100" viewBox="0 0 100 100">
+  <filter id="displace">
+      <feFlood />
+      <feDisplacementMap
+        scale="250"
+        xChannelSelector="R"
+        yChannelSelector="G" />
+  </filter>
+</svg>
+  )HTML");
+
+  Element* target = GetElementById("target");
+  LayoutBox* box = To<LayoutBox>(target->GetLayoutObject());
+  EXPECT_EQ(box->VisualOverflowRectIncludingFilters(),
+            PhysicalRect(-10, -10, 120, 120));
+
+  target->SetInlineStyleProperty(CSSPropertyID::kOpacity, "1");
+  UpdateAllLifecyclePhasesForTest();
+  EXPECT_EQ(box->VisualOverflowRectIncludingFilters(),
+            PhysicalRect(-10, -10, 120, 120));
+}
+
 }  // namespace blink