Align reference box computation for inline boxes with Gecko

third_party/WebKit/Source/core/paint/PaintLayer.cpp

Index: third_party/WebKit/Source/core/paint/PaintLayer.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintLayer.cpp b/third_party/WebKit/Source/core/paint/PaintLayer.cpp
index 37a94ac80e0939e43eb374798ff3684fdb5e86ef..0023fca995480ad91ab50f3517d37182e635d94e 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayer.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayer.cpp
@@ -2061,7 +2061,13 @@ LayoutRect PaintLayer::boxForClipPath() const
 {
     if (!layoutObject()->isBox()) {
         SECURITY_DCHECK(layoutObject()->isLayoutInline());
-        return toLayoutInline(layoutObject())->linesBoundingBox();
+        const LayoutInline& layoutInline = toLayoutInline(*layoutObject());
+        // This somewhat convoluted computation matches what Gecko does.
+        // See crbug.com/641907.
+        LayoutRect inlineBBox = layoutInline.linesBoundingBox();
+        const InlineFlowBox* flowBox = layoutInline.firstLineBox();
+        inlineBBox.setHeight(flowBox ? flowBox->frameRect().height() : LayoutUnit(0));
+        return inlineBBox;
     }
     return toLayoutBox(layoutObject())->borderBoxRect();
 }