WIP: Fix foreignObject cullrect

third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
index af2bed6fa3b128e709ace02be291992f5c2867c9..04a7bd266bf003d6744d286ae00055b7421f1216 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
@@ -390,6 +390,18 @@ void LayoutBoxModelObject::invalidateTreeIfNeeded(const PaintInvalidationState&
         && hasOverflowClip())
         newPaintInvalidationState.setForceSubtreeInvalidationRectUpdateWithinContainer();
 
+    // SVGForeignObject clips descendants and needs to over-invalidate to ensure
+    // newly exposed content repaints.
+    // TODO(pdr): SVGForeignObject supports overflow clipping using a different
+    // approach than LayoutBlock (see LayoutSVGBlock::allowsOverflowClip). This
+    // over-invalidation should be removed when overflow is unified.
+    if (!RuntimeEnabledFeatures::slimmingPaintV2Enabled()
+        && isSVGForeignObject()
+        && !styleRef().isOverflowVisible()
+        && previousPaintInvalidationRect != this->previousPaintInvalidationRect()) {
+        newPaintInvalidationState.setForceSubtreeInvalidationWithinContainer();
+    }
+
     newPaintInvalidationState.updatePaintOffsetAndClipForChildren();
     invalidatePaintOfSubtreesIfNeeded(newPaintInvalidationState);
 }