Don't apply overflow clips in paint invalidation.

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/PaintInvalidationState.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 297 matching lines @@
         if (svgRoot.shouldApplyViewportClip())
             addClipRectRelativeToPaintOffset(LayoutRect(LayoutPoint(), LayoutSize(svgRoot.pixelSnappedSize())));
     } else if (box.isTableRow()) {
         // Child table cell's locationOffset() includes its row's locationOffset().
         m_paintOffset -= box.locationOffset();
     }
 
     if (!box.hasClipRelatedProperty())
         return;
 
-    // Do not clip or scroll for the paint invalidation container, if it scrolls overflow, because it will always use composited
-    // scrolling in this case.
-    if (box == m_paintInvalidationContainer && box.scrollsOverflow()) {
+    // Do not clip or scroll for the paint invalidation container, because the semantics of visual rects do not include clipping or
+    // scrolling on that object.
+    if (box == m_paintInvalidationContainer) {
         DCHECK(!m_clipped); // The box establishes paint invalidation container, so no m_clipped inherited.
     } else {
         // This won't work fully correctly for fixed-position elements, who should receive CSS clip but for whom the current object
         // is not in the containing block chain.
         addClipRectRelativeToPaintOffset(box.clippingRect());
         if (box.hasOverflowClip())
             m_paintOffset -= box.scrolledContentOffset();
     }
 
     // FIXME: <http://bugs.webkit.org/show_bug.cgi?id=13443> Apply control clip if present.
@@ skipping 208 matching lines @@
 }
 
 
 void PaintInvalidatorContextAdapter::mapLocalRectToPaintInvalidationBacking(const LayoutObject& object, LayoutRect& rect) const
 {
     DCHECK(&object == &m_paintInvalidationState.currentObject());
     m_paintInvalidationState.mapLocalRectToPaintInvalidationBacking(rect);
 }
 
 } // namespace blink