Fix invalidation under scroll, and cull rect testing, of flipped-block writing mode elements.

third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp

 /*
  * Copyright (C) 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 997 matching lines @@
     DoubleSize scrollingContentsOffset(overflowClipRect.location().x() - adjustedScrollOffset.width(), overflowClipRect.location().y() - adjustedScrollOffset.height());
     // The scroll offset change is compared using floating point so that fractional scroll offset
     // change can be propagated to compositor.
     if (scrollingContentsOffset != m_scrollingContentsOffset || scrollSize != m_scrollingContentsLayer->size()) {
         bool coordinatorHandlesOffset = compositor()->scrollingLayerDidChange(&m_owningLayer);
         m_scrollingContentsLayer->setPosition(coordinatorHandlesOffset ? FloatPoint() : FloatPoint(-toFloatSize(adjustedScrollOffset)));
     }
     m_scrollingContentsOffset = scrollingContentsOffset;
 
     m_scrollingContentsLayer->setSize(FloatSize(scrollSize));
-    m_scrollingContentsLayer->setOffsetDoubleFromLayoutObject(toIntSize(overflowClipRect.location()), GraphicsLayer::DontSetNeedsDisplay);
+
+    IntPoint scrollingContentsLayerOffsetFromLayoutObject;
+    if (PaintLayerScrollableArea* scrollableArea = m_owningLayer.getScrollableArea()) {
+        scrollingContentsLayerOffsetFromLayoutObject = -scrollableArea->scrollOrigin();
+    }
+    scrollingContentsLayerOffsetFromLayoutObject.moveBy(overflowClipRect.location());
+
+    m_scrollingContentsLayer->setOffsetDoubleFromLayoutObject(toIntSize(scrollingContentsLayerOffsetFromLayoutObject), GraphicsLayer::DontSetNeedsDisplay);
 
     if (m_foregroundLayer) {
         if (m_foregroundLayer->size() != m_scrollingContentsLayer->size())
             m_foregroundLayer->setSize(m_scrollingContentsLayer->size());
         m_foregroundLayer->setNeedsDisplay();
         m_foregroundLayer->setOffsetFromLayoutObject(m_scrollingContentsLayer->offsetFromLayoutObject());
     }
 }
 
 void CompositedLayerMapping::updateChildClippingMaskLayerGeometry()
@@ skipping 1357 matching lines @@
 }
 
 bool CompositedLayerMapping::needsRepaint(const GraphicsLayer& graphicsLayer) const
 {
     return isScrollableAreaLayer(&graphicsLayer) ? true : m_owningLayer.needsRepaint();
 }
 
 void CompositedLayerMapping::adjustForCompositedScrolling(const GraphicsLayer* graphicsLayer, IntSize& offset) const
 {
     if (graphicsLayer == m_scrollingContentsLayer.get() || graphicsLayer == m_foregroundLayer.get()) {
-        if (m_owningLayer.getScrollableArea()) {
-            DoubleSize adjustedScrollOffset = m_owningLayer.getScrollableArea()->adjustedScrollOffset();
-            offset.expand(-adjustedScrollOffset.width(), -adjustedScrollOffset.height());
+        if (PaintLayerScrollableArea* scrollableArea = m_owningLayer.getScrollableArea()) {
+            // Note: this is just the scroll offset, *not* the "adjusted scroll offset". Scroll offset
+            // does not include the origin adjustment. That is instead baked already into offsetFromLayoutObject.
+            DoubleSize scrollOffset = scrollableArea->scrollOffset();
+            offset.expand(-scrollOffset.width(), -scrollOffset.height());
         }
     }
 }
 
 void CompositedLayerMapping::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& context,
     GraphicsLayerPaintingPhase graphicsLayerPaintingPhase, const IntRect& interestRect) const
 {
     // https://code.google.com/p/chromium/issues/detail?id=343772
     DisableCompositingQueryAsserts disabler;
     // Allow throttling to make sure no painting paths (e.g.,
@@ skipping 257 matching lines @@
     } else if (graphicsLayer == m_scrollingContentsLayer.get()) {
         name = "Scrolling Contents Layer";
     } else {
         ASSERT_NOT_REACHED();
     }
 
     return name;
 }
 
 } // namespace blink