Fix paint invalidation of paintInvalidationContainer itself

third_party/WebKit/Source/core/layout/LayoutBlock.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBlock.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlock.cpp b/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
index 3f8799ec95f5e42292ba46a8245f34c343510025..8fcb43a4b190a314681673834cffed492f3a4b6d 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
@@ -356,7 +356,10 @@ void LayoutBlock::invalidatePaintOfSubtreesIfNeeded(PaintInvalidationState& chil
             // If it's a new paint invalidation container, we won't have properly accumulated the offset into the
             // PaintInvalidationState.
             // FIXME: Teach PaintInvalidationState to handle this case. crbug.com/371485
-            if (paintInvalidationContainerForChild != childPaintInvalidationState.paintInvalidationContainer()) {
+            // Note: when the box itself establishes a paint invalidation container, the second part of the condition below
+            // will be true because childPaintInvalidationState.paintInvalidationContainer() is the parent paintInvalidationContainer.
+            // We need the first part of the condition to exclude the case from using ForceHorriblySlowRectMapping.
+            if (&paintInvalidationContainerForChild != box && paintInvalidationContainerForChild != childPaintInvalidationState.paintInvalidationContainer()) {
                 ForceHorriblySlowRectMapping slowRectMapping(&childPaintInvalidationState);
                 PaintInvalidationState disabledPaintInvalidationState(childPaintInvalidationState, *this, paintInvalidationContainerForChild);
                 box->invalidateTreeIfNeeded(disabledPaintInvalidationState);