Fix PaintInvalidationState mapping for absolute whose container is above paintInvalidationContainer

third_party/WebKit/Source/core/layout/PaintInvalidationState.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef PaintInvalidationState_h
 #define PaintInvalidationState_h
 
 #include "core/CoreExport.h"
 #include "platform/geometry/LayoutRect.h"
 #include "platform/transforms/AffineTransform.h"
@@ skipping 66 matching lines @@
 
     PaintLayer& enclosingSelfPaintingLayer(const LayoutObject&) const;
 
 #if ENABLE(ASSERT)
     const LayoutObject& currentObject() const { return m_currentObject; }
 #endif
 
 private:
     friend class VisualRectMappingTest;
 
+    void mapLocalRectToPaintInvalidationContainer(LayoutRect&) const;
+
+    void updateForCurrentObject(const PaintInvalidationState& parentState);
     void updateForNormalChildren();
 
     LayoutRect computePaintInvalidationRectInBackingForSVG() const;
 
     void addClipRectRelativeToPaintOffset(const LayoutRect& localClipRect);
 
     const LayoutObject& m_currentObject;
 
     bool m_forcedSubtreeInvalidationWithinContainer;
     bool m_forcedSubtreeInvalidationRectUpdateWithinContainer;
@@ skipping 40 matching lines @@
     PaintLayer& m_enclosingSelfPaintingLayer;
 
 #if ENABLE(ASSERT)
     bool m_didUpdateForChildren;
 #endif
 };
 
 } // namespace blink
 
 #endif // PaintInvalidationState_h