Fix PaintInvalidationState mapping for absolute whose container is above paintInvalidationContainer

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/PaintInvalidationState.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
 #include "core/layout/LayoutPart.h"
@@ skipping 116 matching lines @@
         // (e.g. LayoutView, and the HorriblySlowRectMapping cases in LayoutBlock::invalidatePaintOfSubtreesIfNeeded()).
         // TODO(wangxianzhu): Avoid this for RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled().
 #if ENABLE(ASSERT)
         m_didUpdateForChildren = parentState.m_didUpdateForChildren;
 #endif
         return;
     }
 
     ASSERT(parentState.m_didUpdateForChildren);
 
-    EPosition position = currentObject.styleRef().position();
-
     if (currentObject.isPaintInvalidationContainer()) {
         m_paintInvalidationContainer = toLayoutBoxModelObject(&currentObject);
-        if (currentObject.styleRef().isStackingContext()) {
+        if (currentObject.styleRef().isStackingContext())
             m_paintInvalidationContainerForStackedContents = toLayoutBoxModelObject(&currentObject);
-            // Adjust cached offsets for absolute-position to be relative to this new paintInvalidationContainer.
-            if (m_cachedOffsetsForAbsolutePositionEnabled && m_cachedOffsetsEnabled) {
-                m_paintOffsetForAbsolutePosition -= m_paintOffset;
-                if (m_clippedForAbsolutePosition)
-                    m_clipRectForAbsolutePosition.move(-m_paintOffset);
-            }
-        }
     } else if (currentObject.isLayoutView()) {
         // m_paintInvalidationContainerForStackedContents is only for stacked descendants in its own frame,
         // because it doesn't establish stacking context for stacked contents in sub-frames.
         // Contents stacked in the root stacking context in this frame should use this frame's paintInvalidationContainer.
         m_paintInvalidationContainerForStackedContents = m_paintInvalidationContainer;
     } else if (currentObject.styleRef().isStacked()
         // This is to exclude some objects (e.g. LayoutText) inheriting stacked style from parent but aren't actually stacked.
         && currentObject.hasLayer()
         && m_paintInvalidationContainer != m_paintInvalidationContainerForStackedContents) {
         // The current object is stacked, so we should use m_paintInvalidationContainerForStackedContents as its
@@ skipping 27 matching lines @@
     }
 
     if (currentObject == m_paintInvalidationContainer) {
         // When we hit a new paint invalidation container, we don't need to
         // continue forcing a check for paint invalidation, since we're
         // descending into a different invalidation container. (For instance if
         // our parents were moved, the entire container will just move.)
         m_forcedSubtreeInvalidationWithinContainer = false;
         m_forcedSubtreeInvalidationRectUpdateWithinContainer = false;
 
+        if (currentObject == m_paintInvalidationContainerForStackedContents
+            && currentObject != m_containerForAbsolutePosition
+            && m_cachedOffsetsForAbsolutePositionEnabled
+            && m_cachedOffsetsEnabled) {
+            // The current object is the new paintInvalidationContainer for absolute-position descendants but is not their container.
+            // Call updateForCurrentObject() before resetting m_paintOffset to get paint offset of the current object
+            // from the original paintInvalidationContainerForStackingContents, then use this paint offset to adjust
+            // m_paintOffsetForAbsolutePosition.
+            updateForCurrentObject(parentState);
+            m_paintOffsetForAbsolutePosition -= m_paintOffset;
+            if (m_clippedForAbsolutePosition)
+                m_clipRectForAbsolutePosition.move(-m_paintOffset);
+        }
+
         m_clipped = false; // Will be updated in updateForChildren().
         m_paintOffset = LayoutSize();
         return;
     }
 
+    updateForCurrentObject(parentState);
+}
+
+void PaintInvalidationState::updateForCurrentObject(const PaintInvalidationState& parentState)
+{
     if (!m_cachedOffsetsEnabled)
         return;
 
-    if (currentObject.isLayoutView()) {
-        ASSERT(&parentState.m_currentObject == toLayoutView(currentObject).frame()->ownerLayoutObject());
+    if (m_currentObject.isLayoutView()) {
+        ASSERT(&parentState.m_currentObject == toLayoutView(m_currentObject).frame()->ownerLayoutObject());
         m_paintOffset += toLayoutBox(parentState.m_currentObject).contentBoxOffset();
         // a LayoutView paints with a defined size but a pixel-rounded offset.
         m_paintOffset = LayoutSize(roundedIntSize(m_paintOffset));
         return;
     }
 
+    EPosition position = m_currentObject.styleRef().position();
+
     if (position == FixedPosition) {
-        if (m_paintInvalidationContainer != currentObject.view() && m_paintInvalidationContainer->view() == currentObject.view()) {
+        if (m_paintInvalidationContainer != m_currentObject.view() && m_paintInvalidationContainer->view() == m_currentObject.view()) {
             // TODO(crbug.com/598762): localToAncestorPoint() is incorrect for fixed-position when paintInvalidationContainer
             // is under the containing LayoutView.
             m_cachedOffsetsEnabled = false;
             return;
         }
         // Use slow path to get the offset of the fixed-position, and enable fast path for descendants.
-        FloatPoint fixedOffset = currentObject.localToAncestorPoint(FloatPoint(), m_paintInvalidationContainer, TraverseDocumentBoundaries);
+        FloatPoint fixedOffset = m_currentObject.localToAncestorPoint(FloatPoint(), m_paintInvalidationContainer, TraverseDocumentBoundaries);
         m_paintOffset = LayoutSize(fixedOffset.x(), fixedOffset.y());
         // In the above way to get paint offset, we can't get accurate clip rect, so just assume no clip.
         // Clip on fixed-position is rare, in case that paintInvalidationContainer crosses frame boundary
         // and the LayoutView is clipped by something in owner document.
         m_clipped = false;
         return;
     }
 
     if (position == AbsolutePosition) {
         m_cachedOffsetsEnabled = m_cachedOffsetsForAbsolutePositionEnabled;
         if (!m_cachedOffsetsEnabled)
             return;
 
         m_paintOffset = m_paintOffsetForAbsolutePosition;
         m_clipped = m_clippedForAbsolutePosition;
         m_clipRect = m_clipRectForAbsolutePosition;
 
         // Handle absolute-position block under relative-position inline.
         const LayoutObject& container = parentState.m_containerForAbsolutePosition;
         if (container.isInFlowPositioned() && container.isLayoutInline())
             m_paintOffset += toLayoutInline(container).offsetForInFlowPositionedInline(toLayoutBox(m_currentObject));
     }
 
-    if (currentObject.isBox())
-        m_paintOffset += toLayoutBox(currentObject).locationOffset();
+    if (m_currentObject.isBox())
+        m_paintOffset += toLayoutBox(m_currentObject).locationOffset();
 
-    if (currentObject.isInFlowPositioned() && currentObject.hasLayer())
-        m_paintOffset += toLayoutBoxModelObject(currentObject).layer()->offsetForInFlowPosition();
+    if (m_currentObject.isInFlowPositioned() && m_currentObject.hasLayer())
+        m_paintOffset += toLayoutBoxModelObject(m_currentObject).layer()->offsetForInFlowPosition();
 }
 
 void PaintInvalidationState::updateForChildren()
 {
 #if ENABLE(ASSERT)
     ASSERT(!m_didUpdateForChildren);
     m_didUpdateForChildren = true;
 #endif
 
     updateForNormalChildren();
@@ skipping 132 matching lines @@
 
 static void slowMapToVisualRectInAncestorSpace(const LayoutObject& object, const LayoutBoxModelObject& ancestor, LayoutRect& rect)
 {
     if (object.isLayoutView()) {
         toLayoutView(object).mapToVisualRectInAncestorSpace(&ancestor, rect, InputIsInFrameCoordinates, DefaultVisualRectFlags);
     } else {
         object.mapToVisualRectInAncestorSpace(&ancestor, rect);
     }
 }
 
-void PaintInvalidationState::mapLocalRectToPaintInvalidationBacking(LayoutRect& rect) const
+void PaintInvalidationState::mapLocalRectToPaintInvalidationContainer(LayoutRect& rect) const
 {
     ASSERT(!m_didUpdateForChildren);
 
     if (m_cachedOffsetsEnabled) {
 #if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
         LayoutRect slowPathRect(rect);
         slowMapToVisualRectInAncestorSpace(m_currentObject, *m_paintInvalidationContainer, slowPathRect);
 #endif
         rect.move(m_paintOffset);
         if (m_clipped)
             rect.intersect(m_clipRect);
 #if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
         // TODO(crbug.com/597902): Slow path misses clipping of paintInvalidationContainer.
         if (m_clipped)
             slowPathRect.intersect(m_clipRect);
         assertRectsEqual(m_currentObject, *m_paintInvalidationContainer, rect, slowPathRect);
 #endif
     } else {
         slowMapToVisualRectInAncestorSpace(m_currentObject, *m_paintInvalidationContainer, rect);
     }
+}
+
+void PaintInvalidationState::mapLocalRectToPaintInvalidationBacking(LayoutRect& rect) const
+{
+    mapLocalRectToPaintInvalidationContainer(rect);
 
     if (m_paintInvalidationContainer->layer()->groupedMapping())
         PaintLayer::mapRectInPaintInvalidationContainerToBacking(*m_paintInvalidationContainer, rect);
 }
 
 void PaintInvalidationState::addClipRectRelativeToPaintOffset(const LayoutRect& localClipRect)
 {
     LayoutRect clipRect = localClipRect;
     clipRect.move(m_paintOffset);
     if (m_clipped) {
         m_clipRect.intersect(clipRect);
     } else {
         m_clipRect = clipRect;
         m_clipped = true;
     }
 }
 
 PaintLayer& PaintInvalidationState::enclosingSelfPaintingLayer(const LayoutObject& layoutObject) const
 {
     if (layoutObject.hasLayer() && toLayoutBoxModelObject(layoutObject).hasSelfPaintingLayer())
         return *toLayoutBoxModelObject(layoutObject).layer();
 
     return m_enclosingSelfPaintingLayer;
 }
 
 } // namespace blink