Ensure SVG PaintOffset is reset at the HTML/SVG boundary [spv2]

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintPropertyTreeBuilder.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 245 matching lines @@
     context.currentTransform = perspective.get();
     object.getMutableForPainting().ensureObjectPaintProperties().setPerspective(perspective.release());
 }
 
 void PaintPropertyTreeBuilder::updateSvgLocalToBorderBoxTransform(const LayoutObject& object, PaintPropertyTreeBuilderContext& context)
 {
     if (!object.isSVGRoot())
         return;
 
     AffineTransform transformToBorderBox = SVGRootPainter(toLayoutSVGRoot(object)).transformToPixelSnappedBorderBox(context.paintOffset);
+
+    // The paint offset is included in |transformToBorderBox| so SVG does not need to handle paint
+    // offset internally.
+    context.paintOffset = LayoutPoint();
+
     if (transformToBorderBox.isIdentity())
         return;
 
     RefPtr<TransformPaintPropertyNode> svgLocalToBorderBoxTransform = TransformPaintPropertyNode::create(
         transformToBorderBox, FloatPoint3D(0, 0, 0), context.currentTransform);
     context.currentTransform = svgLocalToBorderBoxTransform.get();
     context.paintOffset = LayoutPoint();
     object.getMutableForPainting().ensureObjectPaintProperties().setSvgLocalToBorderBoxTransform(svgLocalToBorderBoxTransform.release());
 }
 
@@ skipping 127 matching lines @@
     updateOverflowClip(object, context);
     // TODO(trchen): Insert flattening transform here, as specified by
     // http://www.w3.org/TR/css3-transforms/#transform-style-property
     updatePerspective(object, context);
     updateSvgLocalToBorderBoxTransform(object, context);
     updateScrollTranslation(object, context);
     updateOutOfFlowContext(object, context);
 }
 
 } // namespace blink