Let mapToVisualRectInAncestorSpace apply ancestor clip if not scrollsOverflow

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/PaintInvalidationState.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
 #include "core/layout/LayoutPart.h"
@@ skipping 355 matching lines @@
 LayoutRect PaintInvalidationState::computePaintInvalidationRectInBackingForSVG() const
 {
     LayoutRect rect;
     if (m_cachedOffsetsEnabled) {
         FloatRect svgRect = SVGLayoutSupport::localOverflowRectForPaintInvalidation(m_currentObject);
         rect = SVGLayoutSupport::transformPaintInvalidationRect(m_currentObject, m_svgTransform, svgRect);
         rect.move(m_paintOffset);
         if (m_clipped)
             rect.intersect(m_clipRect);
 #if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
-        // TODO(crbug.com/597902): Slow path misses clipping of paintInvalidationContainer.
         LayoutRect slowPathRect = SVGLayoutSupport::clippedOverflowRectForPaintInvalidation(m_currentObject, *m_paintInvalidationContainer);
-        if (m_clipped)
-            slowPathRect.intersect(m_clipRect);
         assertRectsEqual(m_currentObject, m_paintInvalidationContainer, rect, slowPathRect);
 #endif
     } else {
         // TODO(wangxianzhu): Sometimes m_cachedOffsetsEnabled==false doesn't mean we can't use cached
         // m_svgTransform. We can use hybrid fast path (for SVG) and slow path (for things above the SVGRoot).
         rect = SVGLayoutSupport::clippedOverflowRectForPaintInvalidation(m_currentObject, *m_paintInvalidationContainer);
     }
 
     if (m_paintInvalidationContainer->layer()->groupedMapping())
         PaintLayer::mapRectInPaintInvalidationContainerToBacking(*m_paintInvalidationContainer, rect);
     return rect;
 }
 
 static void slowMapToVisualRectInAncestorSpace(const LayoutObject& object, const LayoutBoxModelObject& ancestor, LayoutRect& rect)
 {
     if (object.isLayoutView()) {
         toLayoutView(object).mapToVisualRectInAncestorSpace(&ancestor, rect, InputIsInFrameCoordinates, DefaultVisualRectFlags);
     } else {
         object.mapToVisualRectInAncestorSpace(&ancestor, rect);
     }
+
+    // LayoutObject::mapToVisualRectInAncestorSpace() doesn't apply overflow clip of ancestor.

[chrishtr, 2016/04/06 23:18:19]

Do any other call sites of mapToVisualRectInAncestorSpace need to apply this
clipping? If so please file a bug.

[Xianzhu, 2016/04/06 23:37:33]

Didn't think of this. Just looked at several callsites and I think we should
apply clipping there in the same way as paint invalidation rects. Will reopen
crbug.com/597902.

+    if (ancestor.isBox() && !ancestor.isLayoutView() && !toLayoutBox(ancestor).scrollsOverflow())
+        rect.intersect(toLayoutBox(ancestor).overflowClipRect(LayoutPoint()));
 }
 
 void PaintInvalidationState::mapLocalRectToPaintInvalidationBacking(LayoutRect& rect) const
 {
     ASSERT(!m_didUpdateForChildren);
 
     if (m_cachedOffsetsEnabled) {
 #if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
         LayoutRect slowPathRect(rect);
         slowMapToVisualRectInAncestorSpace(m_currentObject, *m_paintInvalidationContainer, slowPathRect);
 #endif
         rect.move(m_paintOffset);
         if (m_clipped)
             rect.intersect(m_clipRect);
 #if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
-        // TODO(crbug.com/597902): Slow path misses clipping of paintInvalidationContainer.
-        if (m_clipped)
-            slowPathRect.intersect(m_clipRect);
         assertRectsEqual(m_currentObject, *m_paintInvalidationContainer, rect, slowPathRect);
 #endif
     } else {
         slowMapToVisualRectInAncestorSpace(m_currentObject, *m_paintInvalidationContainer, rect);
     }
 
     if (m_paintInvalidationContainer->layer()->groupedMapping())
         PaintLayer::mapRectInPaintInvalidationContainerToBacking(*m_paintInvalidationContainer, rect);
 }
 
@@ skipping 11 matching lines @@
 
 PaintLayer& PaintInvalidationState::enclosingSelfPaintingLayer(const LayoutObject& layoutObject) const
 {
     if (layoutObject.hasLayer() && toLayoutBoxModelObject(layoutObject).hasSelfPaintingLayer())
         return *toLayoutBoxModelObject(layoutObject).layer();
 
     return m_enclosingSelfPaintingLayer;
 }
 
 } // namespace blink