Take CSS Clip and contain: paint into account when computing visual rects.

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/PaintInvalidationState.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 289 matching lines @@
         }
     } else if (m_currentObject.isSVGRoot()) {
         const LayoutSVGRoot& svgRoot = toLayoutSVGRoot(m_currentObject);
         if (svgRoot.shouldApplyViewportClip())
             addClipRectRelativeToPaintOffset(LayoutRect(LayoutPoint(), LayoutSize(svgRoot.pixelSnappedSize())));
     } else if (m_currentObject.isTableRow()) {
         // Child table cell's locationOffset() includes its row's locationOffset().
         m_paintOffset -= toLayoutBox(m_currentObject).locationOffset();
     }
 
-    if (!m_currentObject.hasOverflowClip())
+    if (!m_currentObject.hasClipRelatedProperty())
         return;
 
     const LayoutBox& box = toLayoutBox(m_currentObject);
 
     // Do not clip or scroll for the paint invalidation container, if it scrolls overflow, because it will always use composited
     // scrolling in this case.
     if (box == m_paintInvalidationContainer && box.scrollsOverflow()) {
         ASSERT(!m_clipped); // The box establishes paint invalidation container, so no m_clipped inherited.
     } else {
-        addClipRectRelativeToPaintOffset(box.overflowClipRect(LayoutPoint()));
-        m_paintOffset -= box.scrolledContentOffset();
+        addClipRectRelativeToPaintOffset(box.clippingRect());

[Xianzhu, 2016/08/12 17:07:57]

The original code won't apply clip on descendant absolute-position objects
unless the current object is the containing block ancestor of the
absolute-position object. This is not fully correct for css clip, but we should
be at the safe side as we won't apply wrong clip.

Please add a comment about this.

[chrishtr, 2016/08/12 17:56:24]

Added one here and in LayoutBox.

+        if (box.hasOverflowClip())
+            m_paintOffset -= box.scrolledContentOffset();
     }
 
     // FIXME: <http://bugs.webkit.org/show_bug.cgi?id=13443> Apply control clip if present.
 }
 
 static FloatPoint slowLocalToAncestorPoint(const LayoutObject& object, const LayoutBoxModelObject& ancestor, const FloatPoint& point)
 {
     if (object.isLayoutView())
         return toLayoutView(object).localToAncestorPoint(point, &ancestor, TraverseDocumentBoundaries | InputIsInFrameCoordinates);
     FloatPoint result = object.localToAncestorPoint(point, &ancestor, TraverseDocumentBoundaries);
@@ skipping 174 matching lines @@
     WTFLogAlways("Fast path paint invalidation rect differs from slow path: fast: %s vs slow: %s",
         fastPathRect.toString().ascii().data(), slowPathRect.toString().ascii().data());
     showLayoutTree(&m_currentObject);
 
     ASSERT_NOT_REACHED();
 }
 
 #endif // CHECK_FAST_PATH_SLOW_PATH_EQUALITY
 
 } // namespace blink