[spv2] Account for flipped writing modes in paint offset

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintPropertyTreeBuilder.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 327 matching lines @@
         break;
     case FixedPosition:
         context.currentTransform = context.transformForFixedPosition;
         context.paintOffset = context.paintOffsetForFixedPosition;
         context.currentClip = context.clipForFixedPosition;
         break;
     default:
         ASSERT_NOT_REACHED();
     }
     if (boxModelObject.isBox()) {
-        context.paintOffset += toLayoutBox(boxModelObject).locationOffset();
+        // TODO(pdr): Several calls in this function walk back up the tree to calculate containers
+        // (e.g., topLeftLocation, offsetForInFlowPosition*). The containing block and other
+        // containers can be stored on PaintPropertyTreeBuilderContext instead of recomputing them.
+        context.paintOffset.moveBy(toLayoutBox(boxModelObject).topLeftLocation());
         // This is a weird quirk that table cells paint as children of table rows,
         // but their location have the row's location baked-in.
         // Similar adjustment is done in LayoutTableCell::offsetFromContainer().
         if (boxModelObject.isTableCell()) {
             LayoutObject* parentRow = boxModelObject.parent();
             ASSERT(parentRow && parentRow->isTableRow());
-            context.paintOffset -= toLayoutBox(parentRow)->locationOffset();
+            context.paintOffset.moveBy(-toLayoutBox(parentRow)->topLeftLocation());
         }
     }
 }
 
 void PaintPropertyTreeBuilder::buildTreeNodes(const LayoutObject& object, PaintPropertyTreeBuilderContext& context)
 {
     object.getMutableForPainting().clearObjectPaintProperties();
 
     deriveBorderBoxFromContainerContext(object, context);
 
     updatePaintOffsetTranslation(object, context);
     updateTransform(object, context);
     updateEffect(object, context);
     updateCssClip(object, context);
     updateLocalBorderBoxContext(object, context);
     updateScrollbarPaintOffset(object, context);
     updateOverflowClip(object, context);
     // TODO(trchen): Insert flattening transform here, as specified by
     // http://www.w3.org/TR/css3-transforms/#transform-style-property
     updatePerspective(object, context);
     updateSvgLocalTransform(object, context);
     updateScrollTranslation(object, context);
     updateOutOfFlowContext(object, context);
 }
 
 } // namespace blink