Fix a bad cast in PaintLayerClipper

third_party/WebKit/Source/core/paint/InlineFlowBoxPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/InlineFlowBoxPainter.h"
 
 #include "core/layout/LayoutBlock.h"
 #include "core/layout/LayoutInline.h"
 #include "core/layout/LayoutView.h"
 #include "core/layout/api/LineLayoutBoxModel.h"
@@ skipping 161 matching lines @@
         if (!hasBorderImage || (!m_inlineFlowBox.prevLineBox() && !m_inlineFlowBox.nextLineBox()))
             return PaintBordersWithoutClip;
 
         // We have a border image that spans multiple lines.
         adjustedClipRect = pixelSnappedIntRect(clipRectForNinePieceImageStrip(m_inlineFlowBox, borderImage, adjustedFrameRect));
         return PaintBordersWithClip;
     }
     return DontPaintBorders;
 }
 
+void InlineFlowBoxPainter::paintBoxShadowAndFillLayers(const PaintInfo& paintInfo, const ComputedStyle& style, LayoutRect& paintRect)
+{
+    // Shadow comes first and is behind the background and border.
+    if (!m_inlineFlowBox.boxModelObject().boxShadowShouldBeAppliedToBackground(BackgroundBleedNone, &m_inlineFlowBox))
+        paintBoxShadow(paintInfo, style, Normal, paintRect);
+
+    Color backgroundColor = m_inlineFlowBox.layoutObject().resolveColor(style, CSSPropertyBackgroundColor);
+    paintFillLayers(paintInfo, backgroundColor, style.backgroundLayers(), paintRect);
+    paintBoxShadow(paintInfo, style, Inset, paintRect);
+}
+
 void InlineFlowBoxPainter::paintBoxDecorationBackground(const PaintInfo& paintInfo, const LayoutPoint& paintOffset, const LayoutRect& cullRect)
 {
     ASSERT(paintInfo.phase == PaintPhaseForeground);
     if (!paintInfo.shouldPaintWithinRoot(&m_inlineFlowBox.layoutObject()) || m_inlineFlowBox.lineLayoutItem().style()->visibility() != VISIBLE)
         return;
 
     // You can use p::first-line to specify a background. If so, the root line boxes for
     // a line may actually have to paint a background.
     const ComputedStyle* styleToUse = m_inlineFlowBox.lineLayoutItem().style(m_inlineFlowBox.isFirstLineStyle());
     bool shouldPaintBoxDecorationBackground;
@@ skipping 15 matching lines @@
     // Move x/y to our coordinates.
     LayoutRect localRect(frameRect);
     m_inlineFlowBox.flipForWritingMode(localRect);
     LayoutPoint adjustedPaintOffset = paintOffset + localRect.location();
 
     LayoutRect adjustedFrameRect = LayoutRect(adjustedPaintOffset, frameRect.size());
 
     IntRect adjustedClipRect;
     BorderPaintingType borderPaintingType = getBorderPaintType(adjustedFrameRect, adjustedClipRect);
 
-    // Shadow comes first and is behind the background and border.
-    if (!m_inlineFlowBox.boxModelObject().boxShadowShouldBeAppliedToBackground(BackgroundBleedNone, &m_inlineFlowBox))
-        paintBoxShadow(paintInfo, *styleToUse, Normal, adjustedFrameRect);
-
-    Color backgroundColor = m_inlineFlowBox.layoutObject().resolveColor(*styleToUse, CSSPropertyBackgroundColor);
-    paintFillLayers(paintInfo, backgroundColor, styleToUse->backgroundLayers(), adjustedFrameRect);
-    paintBoxShadow(paintInfo, *styleToUse, Inset, adjustedFrameRect);
+    if (m_inlineFlowBox.lineLayoutItem().style()->containsPaint()) {
+        GraphicsContextStateSaver stateSaver(paintInfo.context);
+        paintInfo.context.clip(adjustedClipRect);
+        paintBoxShadowAndFillLayers(paintInfo, *styleToUse, adjustedFrameRect);

[chrishtr, 2016/01/14 18:32:56]

Why is it just box shadow and fill layers of inline flow boxes that is a
concern?
Is it really everything?

+    } else {
+        paintBoxShadowAndFillLayers(paintInfo, *styleToUse, adjustedFrameRect);
+    }
 
     switch (borderPaintingType) {
     case DontPaintBorders:
         break;
     case PaintBordersWithoutClip:
         BoxPainter::paintBorder(*toLayoutBoxModelObject(LineLayoutPaintShim::layoutObjectFrom(m_inlineFlowBox.boxModelObject())), paintInfo, adjustedFrameRect, m_inlineFlowBox.lineLayoutItem().styleRef(m_inlineFlowBox.isFirstLineStyle()), BackgroundBleedNone, m_inlineFlowBox.includeLogicalLeftEdge(), m_inlineFlowBox.includeLogicalRightEdge());
         break;
     case PaintBordersWithClip:
         // FIXME: What the heck do we do with RTL here? The math we're using is obviously not right,
         // but it isn't even clear how this should work at all.
@@ skipping 88 matching lines @@
             rect.setHeight(logicalHeight);
         } else {
             rect.setX(logicalTop);
             rect.setWidth(logicalHeight);
         }
     }
     return rect;
 }
 
 } // namespace blink