fix(canvas): confine a named shader effect to its own canvas layer

[shipyard-local]

The bug

A CanvasWidget that is not the whole surface blackens everything painted before it. canvasSetShaderEffect(id, "crt", 0.55) on a small readout screen took the entire host window with it — found in Forge, where one 604×96 canvas erased the app chrome, the plugin panel background and the header.

Cause

SkiaCanvas::save_layer_with_shader_effect handed the SkImageFilters::RuntimeShader straight to push_layer, whose canvas_->saveLayer(&bounds, &layer_paint) treats bounds as a hint once an image filter is attached. A runtime shader reports unbounded output, so the layer grew to the device clip and the restore composited shader output over content the widget never owned.

Only crt exhibits it, because it is the one curated effect that writes opaque pixels where the child is transparent (scanlines + aperture mask). The other five happen to preserve child alpha. Cropping the filter to the layer rect makes containment structural rather than a property every present and future curated effect has to remember to preserve. SkImageFilters::Crop defaults to kDecal, so outside the rect is transparent and surrounding content shows through untouched.

Why the existing tests missed it

Every case in test_canvas_shader_effects.cpp painted the widget at the full surface size ({0,0,kW,kH}, plus {0,0,64,64}) — there was no "outside" to observe. The suite could not have caught this.

Tests

Three cases, each on a real pixel read rather than a smoke check:

• does not paint outside its own canvas — an offset 32×32 widget over a green field must leave that field green, sampled at six points in every direction, for all six effects. Uses CHECK so a regression names every leaking effect, not just the first.
• still renders inside an offset canvas — a vignette confined to a 48×48 widget must still darken that widget's own corners relative to its own centre, so an over-tight crop cannot pass silently.
• layer crop holds under a canvas scale — both properties at 2×. The effect samples in device space while the layer rect is local, so a crop in the wrong coordinate space would pass at 1× and only break under a transform.

Negative control: the first case fails on origin/main (the green field reads (0,0,0) under crt) and passes here.

Verification

pulp-test-canvas-shader-effects 17/17 (2437 assertions). Also green: pulp-test-canvas, -canvas-widget, -canvas-widget-shadow, -canvas-filter-chain, -canvas-capabilities, -canvas-widget-sanitize. Only one call site exists (CanvasWidget::paint).

Verified visually as well as numerically — rendering the same offset crt widget with and without the crop, the interior is pixel-identical across 35,344 sampled pixels (max channel delta 0) while the surrounding field goes from black back to its own color. The effect is unchanged; only its overspill is gone.

Note for consumers

canvasSetShaderEffect is already compiled into shipped Forge binaries and the installed SDK prefix, so both want a rebuild once this lands.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QG7KYpNcdprcaDFrtmzUZC

---

🔎 Provenance

Agent	claude
Machine	m3
Tab	Forge v2
Directory	/Volumes/Workshop/Code/pulp-shader-crop
Session	c5642b40-0090-4a66-9223-3bcc4f4de820

Resume

claude --resume c5642b40-0090-4a66-9223-3bcc4f4de820

Jump to this tab

cmux surface focus 4D22CE8D-A143-4A13-95CA-A51E871F8D9C

Relaunch (any agent)

cmux surface resume get --surface 4D22CE8D-A143-4A13-95CA-A51E871F8D9C

Restore URL — https://claude.ai/code/session_01QG7KYpNcdprcaDFrtmzUZC

_{stamped 2026-07-21 20:33 UTC}