Fix LayoutObject::mapToVisibleRectInContainerSpace()

third_party/WebKit/Source/core/layout/LayoutBox.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBox.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBox.cpp b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
index ecd1d337cc680caf1db759335e61594a0e0cb092..e930cd1356ed109846e8e93dcf94c7f71f7426e5 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBox.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
@@ -939,7 +939,7 @@ IntSize LayoutBox::scrolledContentOffset() const
     return flooredIntSize(layer()->scrollableArea()->scrollOffset());
 }
 
-void LayoutBox::applyCachedScrollOffsetForPaintInvalidation(LayoutRect& paintRect) const
+void LayoutBox::applyOverflowClipAndScrollOffsetForPaintInvalidationIfNeeded(LayoutRect& rect) const
 {
     ASSERT(hasLayer());
     ASSERT(hasOverflowClip());
@@ -951,23 +951,19 @@ void LayoutBox::applyCachedScrollOffsetForPaintInvalidation(LayoutRect& paintRec
         else
             offset.setWidth(-offset.width());
     }
-    paintRect.move(offset);
-}
+    rect.move(offset);
 
-void LayoutBox::applyCachedClipAndScrollOffsetForPaintInvalidation(LayoutRect& paintRect) const
-{
-    ASSERT(hasLayer());
-    ASSERT(hasOverflowClip());
+    if (isPaintInvalidationContainer())

[szager1, 2015/12/18 18:49:21]

This doesn't work for the IntersectionObserver use case (which was the
motivation for my previous change).

Somewhere, the logic needs to explicitly check against the provided
(badly-named) paintInvalidationContainer.  You might also want to rename it to
something that makes it clear this code isn't only used for paint invalidation.

[Xianzhu, 2015/12/18 19:30:51]

Oh I didn't notice that this patch is to fix a recent change. I thought it were
an old paint invalidation bug because crbug.com/567875 is a M48 regression. It's
weird that this patch does fix the bug in M49. Will upload a new patch for M49,
and investigate the bug for M48.

+        return;
 
-    applyCachedScrollOffsetForPaintInvalidation(paintRect);
-    flipForWritingMode(paintRect);
+    flipForWritingMode(rect);
 
     // size() is inaccurate if we're in the middle of a layout of this LayoutBox, so use the
     // layer's size instead. Even if the layer's size is wrong, the layer itself will issue paint invalidations
     // anyway if its size does change.
     LayoutRect clipRect(LayoutPoint(), LayoutSize(layer()->size()));
-    paintRect = intersection(paintRect, clipRect);
-    flipForWritingMode(paintRect);
+    rect = intersection(rect, clipRect);
+    flipForWritingMode(rect);
 }
 
 void LayoutBox::computeIntrinsicLogicalWidths(LayoutUnit& minLogicalWidth, LayoutUnit& maxLogicalWidth) const
@@ -1956,11 +1952,7 @@ void LayoutBox::mapToVisibleRectInContainerSpace(const LayoutBoxModelObject* pai
     // its controlClipRect will be wrong. For overflow clip we use the values cached by the layer.
     rect.setLocation(topLeft);
     if (o->hasOverflowClip()) {
-        LayoutBox* containerBox = toLayoutBox(o);
-        if (o == paintInvalidationContainer)
-            containerBox->applyCachedScrollOffsetForPaintInvalidation(rect);
-        else
-            containerBox->applyCachedClipAndScrollOffsetForPaintInvalidation(rect);
+        toLayoutBox(o)->applyOverflowClipAndScrollOffsetForPaintInvalidationIfNeeded(rect);
         if (rect.isEmpty())
             return;
     }