Fix incorrect paint invalidations with accelerated 2D canvas

Source/core/html/HTMLCanvasElement.cpp

 /*
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 312 matching lines @@
 
 void HTMLCanvasElement::doDeferredPaintInvalidation()
 {
     ASSERT(!m_dirtyRect.isEmpty());
     if (is3D()) {
         didFinalizeFrame();
     } else {
         ASSERT(hasImageBuffer());
         FloatRect srcRect(0, 0, size().width(), size().height());
         m_dirtyRect.intersect(srcRect);
-        LayoutBox* ro = layoutBox();
-        if (ro) {
-            m_imageBuffer->finalizeFrame(mapRect(m_dirtyRect, srcRect, ro->contentBoxRect()));
+        LayoutBox* lb = layoutBox();
+        if (lb) {
+            FloatRect mappedDirtyRect = mapRect(m_dirtyRect, srcRect, lb->contentBoxRect());
+            if (m_context->isAccelerated()) {
+                // Accelerated 2D canvases need the dirty rect to be expressed relative to the
+                // content box, as opposed to the layout box.
+                mappedDirtyRect.move(-lb->contentBoxOffset());
+            }
+            m_imageBuffer->finalizeFrame(mappedDirtyRect);
         } else {
             m_imageBuffer->finalizeFrame(m_dirtyRect);
         }
     }
     ASSERT(m_dirtyRect.isEmpty());
 }
 
 void HTMLCanvasElement::notifyObserversCanvasChanged(const FloatRect& rect)
 {
     for (CanvasObserver* canvasObserver : m_observers)
@@ skipping 541 matching lines @@
 {
     return FloatSize(width(), height());
 }
 
 bool HTMLCanvasElement::isOpaque() const
 {
     return m_context && !m_context->hasAlpha();
 }
 
 } // blink