Fix incorrect paint invalidations with accelerated 2D canvas

Source/core/html/HTMLCanvasElement.cpp

Index: Source/core/html/HTMLCanvasElement.cpp
diff --git a/Source/core/html/HTMLCanvasElement.cpp b/Source/core/html/HTMLCanvasElement.cpp
index 1d67f88bbab316c5776e741edaeada4500e0bbc7..dcea2ec816f4b30b6a59163554175229f280a5d5 100644
--- a/Source/core/html/HTMLCanvasElement.cpp
+++ b/Source/core/html/HTMLCanvasElement.cpp
@@ -330,9 +330,15 @@ void HTMLCanvasElement::doDeferredPaintInvalidation()
         ASSERT(hasImageBuffer());
         FloatRect srcRect(0, 0, size().width(), size().height());
         m_dirtyRect.intersect(srcRect);
-        LayoutBox* ro = layoutBox();
-        if (ro) {
-            m_imageBuffer->finalizeFrame(mapRect(m_dirtyRect, srcRect, ro->contentBoxRect()));
+        LayoutBox* lb = layoutBox();
+        if (lb) {
+            FloatRect mappedDirtyRect = mapRect(m_dirtyRect, srcRect, lb->contentBoxRect());
+            if (m_context->isAccelerated()) {
+                // Accelerated 2D canvases need the dirty rect to be expressed relative to the
+                // content box, as opposed to the layout box.
+                mappedDirtyRect.move(-lb->contentBoxOffset());
+            }
+            m_imageBuffer->finalizeFrame(mappedDirtyRect);
         } else {
             m_imageBuffer->finalizeFrame(m_dirtyRect);
         }