[SPv2] Fix paint offset computation for LayoutTableCell in property tree builder

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintPropertyTreeBuilder.h"
 
 #include "core/frame/FrameView.h"
 #include "core/layout/LayoutPart.h"
 #include "core/layout/LayoutView.h"
 #include "core/paint/ObjectPaintProperties.h"
@@ skipping 89 matching lines @@
         walk(*layoutView, localContext);
 }
 
 static void deriveBorderBoxFromContainerContext(const LayoutObject& object, PaintPropertyTreeBuilderContext& context)
 {
     if (!object.isBoxModelObject())
         return;
 
     const LayoutBoxModelObject& boxModelObject = toLayoutBoxModelObject(object);
 
-    // TODO(trchen): There is some insanity going on with tables. Double check results.
     switch (object.styleRef().position()) {
     case StaticPosition:
         break;
     case RelativePosition:
         context.paintOffset += boxModelObject.offsetForInFlowPosition();
         break;
     case AbsolutePosition:
         context.currentTransform = context.transformForAbsolutePosition;
         context.paintOffset = context.paintOffsetForAbsolutePosition;
         context.currentClip = context.clipForAbsolutePosition;
         break;
     case StickyPosition:
         context.paintOffset += boxModelObject.offsetForInFlowPosition();
         break;
     case FixedPosition:
         context.currentTransform = context.transformForFixedPosition;
         context.paintOffset = context.paintOffsetForFixedPosition;
         context.currentClip = context.clipForFixedPosition;
         break;
     default:
         ASSERT_NOT_REACHED();
     }
-    if (boxModelObject.isBox())
+    if (boxModelObject.isBox()) {
         context.paintOffset += toLayoutBox(boxModelObject).locationOffset();
+        // This is a weird quirk that table cells paint as children of table rows,
+        // but their location have the row's location baked-in.
+        // Similar adjustment is done in LayoutTableCell::offsetFromContainer().
+        if (boxModelObject.isTableCell()) {
+            LayoutObject* parentRow = boxModelObject.parent();
+            ASSERT(parentRow && parentRow->isTableRow());
+            context.paintOffset -= toLayoutBox(parentRow)->locationOffset();
+        }
+    }
 }
 
 static PassRefPtr<TransformPaintPropertyNode> createPaintOffsetTranslationIfNeeded(const LayoutObject& object, PaintPropertyTreeBuilderContext& context)
 {
     bool shouldCreatePaintOffsetTranslationNode = false;
     if (object.isSVGRoot()) {
         // SVG doesn't use paint offset internally so emit a paint offset at the html->svg boundary.
         shouldCreatePaintOffsetTranslationNode = true;
     } else if (object.isBoxModelObject()) {
         // TODO(trchen): Eliminate PaintLayer dependency.
@@ skipping 232 matching lines @@
 
     if (object.isLayoutPart()) {
         Widget* widget = toLayoutPart(object).widget();
         if (widget && widget->isFrameView())
             walk(*toFrameView(widget), localContext);
         // TODO(pdr): Investigate RemoteFrameView (crbug.com/579281).
     }
 }
 
 } // namespace blink