Fix CSS reference filters with negative transformed children.

third_party/WebKit/Source/core/paint/BoxReflectionUtils.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/BoxReflectionUtils.h"
 
 #include "core/layout/LayoutBox.h"
 #include "core/paint/NinePieceImagePainter.h"
 #include "core/paint/PaintLayer.h"
 #include "platform/LengthFunctions.h"
@@ skipping 26 matching lines @@
     case ReflectionLeft:
         direction = BoxReflection::HorizontalReflection;
         offset = -floatValueForLength(reflectStyle->offset(), frameRect.width());
         break;
     case ReflectionRight:
         direction = BoxReflection::HorizontalReflection;
         offset = 2 * frameRect.width() + floatValueForLength(reflectStyle->offset(), frameRect.width());
         break;
     }
 
-    // Since the filter origin is the corner of the input bounds, which may
-    // include visual overflow (e.g. due to box-shadow), we must adjust the
-    // offset to also account for this offset (this is equivalent to using
-    // SkLocalMatrixImageFilter, but simpler).
-    // The rect used here should match the one used in FilterPainter.
-    LayoutRect filterInputBounds = layer.physicalBoundingBoxIncludingReflectionAndStackingChildren(LayoutPoint());
-    offset -= 2 * (direction == BoxReflection::VerticalReflection ? filterInputBounds.y() : filterInputBounds.x()).toFloat();
-
     RefPtr<SkPicture> mask;
     const NinePieceImage& maskNinePiece = reflectStyle->mask();
     if (maskNinePiece.hasImage()) {
         LayoutRect maskRect(LayoutPoint(), frameLayoutRect.size());
-        maskRect.moveBy(-filterInputBounds.location());
-
         LayoutRect maskBoundingRect(maskRect);
         maskBoundingRect.expand(style.imageOutsets(maskNinePiece));
         FloatRect maskBoundingFloatRect(maskBoundingRect);
 
         // TODO(jbroman): SkPictureBuilder + DrawingRecorder seems excessive.
         // If NinePieceImagePainter operated on SkCanvas, we'd only need an
         // SkPictureRecorder here.
         SkPictureBuilder recorder(maskBoundingFloatRect);
         {
             GraphicsContext& context = recorder.context();
             DrawingRecorder drawingRecorder(context, *layer.layoutObject(), DisplayItem::ReflectionMask, maskBoundingFloatRect);
             NinePieceImagePainter(*layer.layoutObject()).paint(
                 recorder.context(), maskRect, style, maskNinePiece, SkXfermode::kSrcOver_Mode);
         }
         mask = recorder.endRecording();
     }
 
     return BoxReflection(direction, offset, mask);
 }
 
 } // namespace blink