Ensure SVG PaintOffset is reset at the HTML/SVG boundary [spv2]

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintPropertyTreeBuilder.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 245 matching lines @@
     context.currentTransform = perspective.get();
     object.getMutableForPainting().ensureObjectPaintProperties().setPerspective(perspective.release());
 }
 
 void PaintPropertyTreeBuilder::updateSvgLocalToBorderBoxTransform(const LayoutObject& object, PaintPropertyTreeBuilderContext& context)
 {
     if (!object.isSVGRoot())
         return;
 
     AffineTransform transformToBorderBox = SVGRootPainter(toLayoutSVGRoot(object)).transformToPixelSnappedBorderBox(context.paintOffset);
-    if (transformToBorderBox.isIdentity())
+    if (transformToBorderBox.isIdentity()) {

[chrishtr, 2016/07/08 15:07:03]

What does paintOffset being zero have to do with transformToBorderBox being
identity? Is identity an indirect way to check
for the boundary between SVG and HTML?

Also, why did it crash before this CL?

+        // SVG does not use paint offset internally so ensure it is set to zero. Pixel snapping can
+        // cause an identity |transformToBorderBox| even though |context.paintOffset| is non-zero.
+        context.paintOffset = LayoutPoint();

[chrishtr, 2016/07/08 17:40:21]

How about just moving this line up above 266 then, deleting line 276, and adding
a comment that paint offset is not used
within SVG, and it's instead stored in |transformToBorderBox|. paintOffset is
not used after line 265.

[pdr., 2016/07/08 18:04:40]

Sounds reasonable, done.

PTAL

         return;
+    }
 
     RefPtr<TransformPaintPropertyNode> svgLocalToBorderBoxTransform = TransformPaintPropertyNode::create(
         transformToBorderBox, FloatPoint3D(0, 0, 0), context.currentTransform);
     context.currentTransform = svgLocalToBorderBoxTransform.get();
     context.paintOffset = LayoutPoint();
     object.getMutableForPainting().ensureObjectPaintProperties().setSvgLocalToBorderBoxTransform(svgLocalToBorderBoxTransform.release());
 }
 
 void PaintPropertyTreeBuilder::updateScrollTranslation(const LayoutObject& object, PaintPropertyTreeBuilderContext& context)
 {
@@ skipping 125 matching lines @@
     updateOverflowClip(object, context);
     // TODO(trchen): Insert flattening transform here, as specified by
     // http://www.w3.org/TR/css3-transforms/#transform-style-property
     updatePerspective(object, context);
     updateSvgLocalToBorderBoxTransform(object, context);
     updateScrollTranslation(object, context);
     updateOutOfFlowContext(object, context);
 }
 
 } // namespace blink