Fix clip-path reference box/coordinate space setup for hit-testing

third_party/WebKit/Source/core/paint/PaintLayer.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
  *   Randall Jesup <rjesup@wgate.com>
@@ skipping 2039 matching lines @@
             if (!result.hitTestRequest().listBased())
                 result = tempResult;
             if (!depthSortDescendants)
                 break;
         }
     }
 
     return resultLayer;
 }
 
+LayoutRect PaintLayer::computeReferenceBox() const
+{
+    if (!layoutObject()->isBox()) {
+        SECURITY_DCHECK(layoutObject()->isLayoutInline());
+        return toLayoutInline(layoutObject())->linesBoundingBox();
+    }
+    return toLayoutBox(layoutObject())->borderBoxRect();
+}
+
 bool PaintLayer::hitTestClippedOutByClipPath(PaintLayer* rootLayer, const HitTestLocation& hitTestLocation) const
 {
     if (!layoutObject()->hasClipPath())
         return false;
-    ASSERT(isSelfPaintingLayer());
+    DCHECK(isSelfPaintingLayer());
 
     LayoutPoint offsetToRootLayer;
-    if (rootLayer)
-        convertToLayerCoords(rootLayer, offsetToRootLayer);
-    LayoutRect rootRelativeBounds = physicalBoundingBoxIncludingReflectionAndStackingChildren(offsetToRootLayer);
+    convertToLayerCoords(rootLayer, offsetToRootLayer);

[Stephen Chennney, 2016/08/26 14:19:28]

I infer that this method can handle a null rootLayer, or rootLayer is never
null. If the latter, we should DCHECK it.

[fs, 2016/08/26 14:41:51]

Yeah, my assumption is the latter (corroborated by codesearch; it always starts
out as 'this' AFAICS.)

+    LayoutRect referenceBox(computeReferenceBox());
+    referenceBox.moveBy(offsetToRootLayer);
+
+    FloatPoint point(hitTestLocation.point());
 
     ClipPathOperation* clipPathOperation = layoutObject()->style()->clipPath();
-    ASSERT(clipPathOperation);
+    DCHECK(clipPathOperation);
     if (clipPathOperation->type() == ClipPathOperation::SHAPE) {
         ShapeClipPathOperation* clipPath = toShapeClipPathOperation(clipPathOperation);
-        if (!clipPath->path(FloatRect(rootRelativeBounds)).contains(FloatPoint(hitTestLocation.point())))
-            return true;
-    } else {
-        ASSERT(clipPathOperation->type() == ClipPathOperation::REFERENCE);
-        ReferenceClipPathOperation* referenceClipPathOperation = toReferenceClipPathOperation(clipPathOperation);
-        Element* element = layoutObject()->document().getElementById(referenceClipPathOperation->fragment());
-        if (isSVGClipPathElement(element) && element->layoutObject()) {
-            LayoutSVGResourceClipper* clipper = toLayoutSVGResourceClipper(toLayoutSVGResourceContainer(element->layoutObject()));
-            if (!clipper->hitTestClipContent(FloatRect(rootRelativeBounds), FloatPoint(hitTestLocation.point())))
-                return true;
-        }
+        return !clipPath->path(FloatRect(referenceBox)).contains(point);
     }
-
-    return false;
+    DCHECK_EQ(clipPathOperation->type(), ClipPathOperation::REFERENCE);
+    ReferenceClipPathOperation* referenceClipPathOperation = toReferenceClipPathOperation(clipPathOperation);
+    Element* element = layoutObject()->document().getElementById(referenceClipPathOperation->fragment());
+    if (!isSVGClipPathElement(element) || !element->layoutObject())
+        return false;
+    LayoutSVGResourceClipper* clipper =
+        toLayoutSVGResourceClipper(toLayoutSVGResourceContainer(element->layoutObject()));
+    // If the clipPath is using "userspace on use" units, then the origin of
+    // the coordinate system is the top-left of the reference box, so adjust
+    // the point accordingly.
+    if (clipper->clipPathUnits() == SVGUnitTypes::kSvgUnitTypeUserspaceonuse)
+        point.moveBy(-offsetToRootLayer);
+    return !clipper->hitTestClipContent(FloatRect(referenceBox), point);
 }
 
 bool PaintLayer::intersectsDamageRect(const LayoutRect& layerBounds, const LayoutRect& damageRect, const LayoutPoint& offsetFromRoot) const
 {
     // Always examine the canvas and the root.
     // FIXME: Could eliminate the isDocumentElement() check if we fix background painting so that the LayoutView
     // paints the root's background.
     if (isRootLayer() || layoutObject()->isDocumentElement())
         return true;
 
@@ skipping 836 matching lines @@
 
 void showLayerTree(const blink::LayoutObject* layoutObject)
 {
     if (!layoutObject) {
         fprintf(stderr, "Cannot showLayerTree. Root is (nil)\n");
         return;
     }
     showLayerTree(layoutObject->enclosingLayer());
 }
 #endif