[SP] Fix cull rect for fieldset painting

Source/core/paint/FieldsetPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/paint/FieldsetPainter.h"
 
 #include "core/layout/LayoutFieldset.h"
 #include "core/paint/BoxDecorationData.h"
 #include "core/paint/BoxPainter.h"
@@ skipping 18 matching lines @@
     if (m_layoutFieldset.style()->isHorizontalWritingMode()) {
         LayoutUnit yOff = (legend->location().y() > 0) ? LayoutUnit() : (legend->size().height() - m_layoutFieldset.borderTop()) / 2;
         paintRect.setHeight(paintRect.height() - yOff);
         paintRect.setY(paintRect.y() + yOff);
     } else {
         LayoutUnit xOff = (legend->location().x() > 0) ? LayoutUnit() : (legend->size().width() - m_layoutFieldset.borderLeft()) / 2;
         paintRect.setWidth(paintRect.width() - xOff);
         paintRect.setX(paintRect.x() + xOff);
     }
 
-    LayoutObjectDrawingRecorder recorder(*paintInfo.context, m_layoutFieldset, paintInfo.phase, pixelSnappedIntRect(paintOffset, paintRect.size()));
+    LayoutObjectDrawingRecorder recorder(*paintInfo.context, m_layoutFieldset, paintInfo.phase, pixelSnappedIntRect(paintRect));
     if (recorder.canUseCachedDrawing())
         return;
 
     BoxDecorationData boxDecorationData(m_layoutFieldset);
 
     if (boxDecorationData.bleedAvoidance == BackgroundBleedNone)
         BoxPainter::paintBoxShadow(paintInfo, paintRect, m_layoutFieldset.styleRef(), Normal);
     BoxPainter(m_layoutFieldset).paintFillLayers(paintInfo, boxDecorationData.backgroundColor, m_layoutFieldset.style()->backgroundLayers(), paintRect);
     BoxPainter::paintBoxShadow(paintInfo, paintRect, m_layoutFieldset.styleRef(), Inset);
 
@@ skipping 40 matching lines @@
     } else {
         LayoutUnit xOff = (legend->location().x() > 0) ? LayoutUnit() : (legend->size().width() - m_layoutFieldset.borderLeft()) / 2;
         paintRect.expand(-xOff, 0);
         paintRect.move(xOff, 0);
     }
 
     BoxPainter(m_layoutFieldset).paintMaskImages(paintInfo, paintRect);
 }
 
 } // namespace blink