LayoutBox::mapContentsRectToVisibleRectInBorderBoxSpace()

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

Index: third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
diff --git a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
index c028923fec57512ec3e6b4dec38e6a62fffbbc24..186436488ccf9776277072c127f4e8d1d7fb6753 100644
--- a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
+++ b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
@@ -17,7 +17,7 @@
 // We can't enable this by default because saturated operations of LayoutUnit
 // don't conform commutative law for overflowing results, preventing us from
 // making fast-path and slow-path always return the same result.
-#define ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH (0 && ENABLE(ASSERT))
+#define ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH (1 && ENABLE(ASSERT))
 
 namespace blink {
 
@@ -265,9 +265,6 @@ LayoutRect PaintInvalidationState::computePaintInvalidationRectInBackingForSVG()
             rect.intersect(m_clipRect);
 #if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
         LayoutRect slowPathRect = SVGLayoutSupport::clippedOverflowRectForPaintInvalidation(m_currentObject, m_paintInvalidationContainer);
-        // TODO(crbug.com/597902): Slow path misses clipping of paintInvalidationContainer.
-        if (m_clipped)
-            slowPathRect.intersect(m_clipRect);
         // TODO(crbug.com/597903): Fast path and slow path should generate equal empty rects.
         ASSERT((rect.isEmpty() && slowPathRect.isEmpty()) || rect == slowPathRect);
 #endif
@@ -284,11 +281,6 @@ LayoutRect PaintInvalidationState::computePaintInvalidationRectInBackingForSVG()
 
 static void slowMapToVisibleRectInAncestorSpace(const LayoutObject& object, const LayoutBoxModelObject& ancestor, LayoutRect& rect)
 {
-    // TODO(crbug.com/597965): LayoutBox::mapToVisibleRectInAncestorSpace() incorrectly flips a rect
-    // in its own space for writing mode. Here flip to workaround the flip.
-    if (object.isBox() && (toLayoutBox(object).isWritingModeRoot() || (ancestor == object && object.styleRef().isFlippedBlocksWritingMode())))
-        toLayoutBox(object).flipForWritingMode(rect);
-
     if (object.isLayoutView()) {
         toLayoutView(object).mapToVisibleRectInAncestorSpace(&ancestor, rect, InputIsInFrameCoordinates, DefaultVisibleRectFlags);
     } else if (object.isSVGRoot()) {
@@ -313,9 +305,6 @@ void PaintInvalidationState::mapLocalRectToPaintInvalidationBacking(LayoutRect&
             rect.intersect(m_clipRect);
 #if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
         // Make sure that the fast path and the slow path generate the same rect.
-        // TODO(crbug.com/597902): Slow path misses clipping of paintInvalidationContainer.
-        if (m_clipped)
-            slowPathRect.intersect(m_clipRect);
         // TODO(wangxianzhu): The isLayoutView() condition is for cases that a sub-frame creates a
         // root PaintInvalidationState which doesn't inherit clip from ancestor frames.
         // Remove the condition when we eliminate the latter case of PaintInvalidationState(const LayoutView&, ...).