Take CSS Clip and contain: paint into account when computing visual rects.

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

Index: third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
diff --git a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
index 38b038675cbb64788c7cefe6ccfa91911c56cc40..b5849eaeddc545a90a7b02f88aa2b1a15113a331 100644
--- a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
+++ b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
@@ -307,7 +307,7 @@ void PaintInvalidationState::updateForNormalChildren()
         m_paintOffset -= toLayoutBox(m_currentObject).locationOffset();
     }
 
-    if (!m_currentObject.hasOverflowClip())
+    if (!m_currentObject.hasClipRelatedProperty())
         return;
 
     const LayoutBox& box = toLayoutBox(m_currentObject);
@@ -317,8 +317,9 @@ void PaintInvalidationState::updateForNormalChildren()
     if (box == m_paintInvalidationContainer && box.scrollsOverflow()) {
         ASSERT(!m_clipped); // The box establishes paint invalidation container, so no m_clipped inherited.
     } else {
-        addClipRectRelativeToPaintOffset(box.overflowClipRect(LayoutPoint()));
-        m_paintOffset -= box.scrolledContentOffset();
+        addClipRectRelativeToPaintOffset(box.clippingRect());

[Xianzhu, 2016/08/12 17:07:57]

The original code won't apply clip on descendant absolute-position objects
unless the current object is the containing block ancestor of the
absolute-position object. This is not fully correct for css clip, but we should
be at the safe side as we won't apply wrong clip.

Please add a comment about this.

[chrishtr, 2016/08/12 17:56:24]

Added one here and in LayoutBox.

+        if (box.hasOverflowClip())
+            m_paintOffset -= box.scrolledContentOffset();
     }
 
     // FIXME: <http://bugs.webkit.org/show_bug.cgi?id=13443> Apply control clip if present.