Fix invalidation of absolute sized SVG content.

third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 394 matching lines @@
 
     // TODO(wangxianzhu): This is a workaround for crbug.com/490725. We don't have enough saved information to do accurate check
     // of clipping change. Will remove when we remove rect-based paint invalidation.
     if (!RuntimeEnabledFeatures::slimmingPaintV2Enabled()
         && previousPaintInvalidationRect != this->previousPaintInvalidationRect()
         && !usesCompositedScrolling()
         // Note that isLayoutView() below becomes unnecessary after the launch of root layer scrolling.
         && (hasOverflowClip() || isLayoutView()))
         newPaintInvalidationState.setForceSubtreeInvalidationRectUpdateWithinContainer();
 
+    // Another variant of crbug.com/490725 -- absolute sized SVG content must be
+    // forcibly invalidated when the paint invalidation rect changes.
+    if (!RuntimeEnabledFeatures::slimmingPaintV2Enabled()
+        && isSVG()
+        && previousPaintInvalidationRect != this->previousPaintInvalidationRect()
+        && !styleRef().isOverflowVisible())
+        newPaintInvalidationState.setForceSubtreeInvalidationRectUpdateWithinContainer();
+
     newPaintInvalidationState.updateForChildren(reason);
     invalidatePaintOfSubtreesIfNeeded(newPaintInvalidationState);
 }
 
 void LayoutBoxModelObject::addOutlineRectsForNormalChildren(Vector<LayoutRect>& rects, const LayoutPoint& additionalOffset, IncludeBlockVisualOverflowOrNot includeBlockOverflows) const
 {
     for (LayoutObject* child = slowFirstChild(); child; child = child->nextSibling()) {
         // Outlines of out-of-flow positioned descendants are handled in LayoutBlock::addOutlineRects().
         if (child->isOutOfFlowPositioned())
             continue;
@@ skipping 680 matching lines @@
     if (rootElementStyle->hasBackground())
         return false;
 
     if (node() != document().firstBodyElement())
         return false;
 
     return true;
 }
 
 } // namespace blink