Fix paint invalidation of paintInvalidationContainer itself

third_party/WebKit/Source/core/layout/LayoutBox.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBox.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBox.cpp b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
index 71fc4248e32f484e2cc9f956f8fa2c97926aa084..13f2934ffb5c1a82ebea31200ea2a2a1f46b73cd 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBox.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
@@ -1901,6 +1901,15 @@ void LayoutBox::mapToVisibleRectInAncestorSpace(const LayoutBoxModelObject* ance
     // included into the visual overflow for repaint, we wouldn't have this issue.
     inflatePaintInvalidationRectForReflectionAndFilter(rect);
 
+    // This condition should be put before the paintInvalidationState logic because the latter
+    // can't handle the case. We also can't let PaintInvalidationState handle the case, because
+    // this code is also needed when there is no PaintInvalidationState.

[chrishtr, 2016/03/11 22:11:44]

TODO(wangxianzhu): refactor to fix this code structure.

[Xianzhu, 2016/03/11 22:30:51]

Done.

+    if (ancestor == this) {
+        if (ancestor->style()->isFlippedBlocksWritingMode())
+            flipForWritingMode(rect);
+        return;
+    }
+
     if (paintInvalidationState && paintInvalidationState->canMapToContainer(ancestor) && position != FixedPosition) {
         if (layer() && layer()->transform())
             rect = LayoutRect(layer()->transform()->mapRect(pixelSnappedIntRect(rect)));
@@ -1916,12 +1925,6 @@ void LayoutBox::mapToVisibleRectInAncestorSpace(const LayoutBoxModelObject* ance
         return;
     }
 
-    if (ancestor == this) {
-        if (ancestor->style()->isFlippedBlocksWritingMode())
-            flipForWritingMode(rect);
-        return;
-    }
-
     bool containerSkipped;
     LayoutObject* container = this->container(ancestor, &containerSkipped);
     if (!container)