Fix LayoutObject::mapToVisibleRectInContainerSpace()

third_party/WebKit/Source/core/layout/LayoutBox.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 921 matching lines @@
 }
 
 IntSize LayoutBox::scrolledContentOffset() const
 {
     ASSERT(hasOverflowClip());
     ASSERT(hasLayer());
     // FIXME: Return DoubleSize here. crbug.com/414283.
     return flooredIntSize(layer()->scrollableArea()->scrollOffset());
 }
 
-void LayoutBox::applyCachedScrollOffsetForPaintInvalidation(LayoutRect& paintRect) const
+void LayoutBox::applyOverflowClipAndScrollOffsetForPaintInvalidationIfNeeded(LayoutRect& rect) const
 {
     ASSERT(hasLayer());
     ASSERT(hasOverflowClip());
 
     LayoutSize offset = LayoutSize(-scrolledContentOffset());
     if (UNLIKELY(hasFlippedBlocksWritingMode())) {
         if (isHorizontalWritingMode())
             offset.setHeight(-offset.height());
         else
             offset.setWidth(-offset.width());
     }
-    paintRect.move(offset);
-}
+    rect.move(offset);
 
-void LayoutBox::applyCachedClipAndScrollOffsetForPaintInvalidation(LayoutRect& paintRect) const
-{
-    ASSERT(hasLayer());
-    ASSERT(hasOverflowClip());
+    if (isPaintInvalidationContainer())

[szager1, 2015/12/18 18:49:21]

This doesn't work for the IntersectionObserver use case (which was the
motivation for my previous change).

Somewhere, the logic needs to explicitly check against the provided
(badly-named) paintInvalidationContainer.  You might also want to rename it to
something that makes it clear this code isn't only used for paint invalidation.

[Xianzhu, 2015/12/18 19:30:51]

Oh I didn't notice that this patch is to fix a recent change. I thought it were
an old paint invalidation bug because crbug.com/567875 is a M48 regression. It's
weird that this patch does fix the bug in M49. Will upload a new patch for M49,
and investigate the bug for M48.

+        return;
 
-    applyCachedScrollOffsetForPaintInvalidation(paintRect);
-    flipForWritingMode(paintRect);
+    flipForWritingMode(rect);
 
     // size() is inaccurate if we're in the middle of a layout of this LayoutBox, so use the
     // layer's size instead. Even if the layer's size is wrong, the layer itself will issue paint invalidations
     // anyway if its size does change.
     LayoutRect clipRect(LayoutPoint(), LayoutSize(layer()->size()));
-    paintRect = intersection(paintRect, clipRect);
-    flipForWritingMode(paintRect);
+    rect = intersection(rect, clipRect);
+    flipForWritingMode(rect);
 }
 
 void LayoutBox::computeIntrinsicLogicalWidths(LayoutUnit& minLogicalWidth, LayoutUnit& maxLogicalWidth) const
 {
     minLogicalWidth = minPreferredLogicalWidth() - borderAndPaddingLogicalWidth();
     maxLogicalWidth = maxPreferredLogicalWidth() - borderAndPaddingLogicalWidth();
 }
 
 LayoutUnit LayoutBox::minPreferredLogicalWidth() const
 {
@@ skipping 968 matching lines @@
         // is translated, but the layout box isn't, so we need to do this to get the
         // right dirty rect.  Since this is called from LayoutObject::setStyle, the relative position
         // flag on the LayoutObject has been cleared, so use the one on the style().
         topLeft += layer()->offsetForInFlowPosition();
     }
 
     // FIXME: We ignore the lightweight clipping rect that controls use, since if |o| is in mid-layout,
     // its controlClipRect will be wrong. For overflow clip we use the values cached by the layer.
     rect.setLocation(topLeft);
     if (o->hasOverflowClip()) {
-        LayoutBox* containerBox = toLayoutBox(o);
-        if (o == paintInvalidationContainer)
-            containerBox->applyCachedScrollOffsetForPaintInvalidation(rect);
-        else
-            containerBox->applyCachedClipAndScrollOffsetForPaintInvalidation(rect);
+        toLayoutBox(o)->applyOverflowClipAndScrollOffsetForPaintInvalidationIfNeeded(rect);
         if (rect.isEmpty())
             return;
     }
 
     if (containerSkipped) {
         // If the paintInvalidationContainer is below o, then we need to map the rect into paintInvalidationContainer's coordinates.
         LayoutSize containerOffset = paintInvalidationContainer->offsetFromAncestorContainer(o);
         rect.move(-containerOffset);
         // If the paintInvalidationContainer is fixed, then the rect is already in its coordinates so doesn't need viewport-adjusting.
         if (paintInvalidationContainer->style()->position() != FixedPosition && o->isLayoutView())
@@ skipping 2911 matching lines @@
 }
 
 void LayoutBox::clearPreviousPaintInvalidationRects()
 {
     LayoutBoxModelObject::clearPreviousPaintInvalidationRects();
     if (PaintLayerScrollableArea* scrollableArea = this->scrollableArea())
         scrollableArea->clearPreviousPaintInvalidationRects();
 }
 
 } // namespace blink