Ensure SVG PaintOffset is reset at the HTML/SVG boundary [spv2]

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

Index: third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
index 65fa062fec1928cf21f29f08e7921510a16f5077..f3b52d559efd546235df4ad7ed619d5808e0e625 100644
--- a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
@@ -263,8 +263,12 @@ void PaintPropertyTreeBuilder::updateSvgLocalToBorderBoxTransform(const LayoutOb
         return;
 
     AffineTransform transformToBorderBox = SVGRootPainter(toLayoutSVGRoot(object)).transformToPixelSnappedBorderBox(context.paintOffset);
-    if (transformToBorderBox.isIdentity())
+    if (transformToBorderBox.isIdentity()) {

[chrishtr, 2016/07/08 15:07:03]

What does paintOffset being zero have to do with transformToBorderBox being
identity? Is identity an indirect way to check
for the boundary between SVG and HTML?

Also, why did it crash before this CL?

+        // SVG does not use paint offset internally so ensure it is set to zero. Pixel snapping can
+        // cause an identity |transformToBorderBox| even though |context.paintOffset| is non-zero.
+        context.paintOffset = LayoutPoint();

[chrishtr, 2016/07/08 17:40:21]

How about just moving this line up above 266 then, deleting line 276, and adding
a comment that paint offset is not used
within SVG, and it's instead stored in |transformToBorderBox|. paintOffset is
not used after line 265.

[pdr., 2016/07/08 18:04:40]

Sounds reasonable, done.

PTAL

         return;
+    }
 
     RefPtr<TransformPaintPropertyNode> svgLocalToBorderBoxTransform = TransformPaintPropertyNode::create(
         transformToBorderBox, FloatPoint3D(0, 0, 0), context.currentTransform);