Correct flip of paint invalidation rect in PaintInvalidator

third_party/WebKit/Source/core/paint/PaintInvalidator.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintInvalidator.h"
 
 #include "core/editing/FrameSelection.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
@@ skipping 26 matching lines @@
 }
 
 // TODO(wangxianzhu): Combine this into PaintInvalidator::mapLocalRectToPaintInvalidationBacking() when removing PaintInvalidationState.
 static LayoutRect mapLocalRectToPaintInvalidationBacking(GeometryMapper& geometryMapper, const LayoutObject& object, const FloatRect& localRect, const PaintInvalidatorContext& context)
 {
     // TODO(wkorman): The flip below is required because visual rects are
     // currently in "physical coordinates with flipped block-flow direction"
     // (see LayoutBoxModelObject.h) but we need them to be in physical
     // coordinates.
     FloatRect rect = localRect;
-    if (object.isBox())
+    if (object.isBox()) {
         toLayoutBox(object).flipForWritingMode(rect);
+    } else if (!(context.forcedSubtreeInvalidationFlags & PaintInvalidatorContext::ForcedSubtreeSlowPathRect)) {
+        // For SPv2 and the GeometryMapper path, we also need to convert the rect
+        // for non-boxes into physical coordinates before applying paint offset.
+        // (Otherwise we'll call mapToVisualrectInAncestorSpace() which requires
+        // physical coordinates for boxes, but "physical coordinates with flipped
+        // block-flow direction" for non-boxes for which we don't need to flip.)
+        // TODO(wangxianzhu): Avoid containingBlock().
+        object.containingBlock()->flipForWritingMode(rect);
+    }
 
     if (RuntimeEnabledFeatures::slimmingPaintV2Enabled()) {
         // In SPv2, visual rects are in the space of their local transform node.
         rect.moveBy(FloatPoint(context.treeBuilderContext.current.paintOffset));
         return LayoutRect(rect);
     }
 
     LayoutRect result;
     if (context.forcedSubtreeInvalidationFlags & PaintInvalidatorContext::ForcedSubtreeSlowPathRect) {
         result = slowMapToVisualRectInAncestorSpace(object, *context.paintInvalidationContainer, rect);
@@ skipping 124 matching lines @@
     }
 
     DCHECK(context.paintInvalidationContainer == object.containerForPaintInvalidation());
     DCHECK(context.paintingLayer == object.paintingLayer());
 
     if (object.mayNeedPaintInvalidationSubtree())
         context.forcedSubtreeInvalidationFlags |= PaintInvalidatorContext::ForcedSubtreeInvalidationChecking;
 
     // TODO(crbug.com/637313): This is temporary before we support filters in paint property tree.
     // TODO(crbug.com/648274): This is a workaround for multi-column contents.
-    // TODO(crbug.com/648409): This is a workaround for inline contents in vertical-rl container.
-    if (object.hasFilterInducingProperty() || object.isLayoutFlowThread() || object.hasFlippedBlocksWritingMode())
+    if (object.hasFilterInducingProperty() || object.isLayoutFlowThread())
         context.forcedSubtreeInvalidationFlags |= PaintInvalidatorContext::ForcedSubtreeSlowPathRect;
 
     context.oldBounds = object.previousPaintInvalidationRect();
     context.oldLocation = object.previousPositionFromPaintInvalidationBacking();
     context.newBounds = computePaintInvalidationRectInBacking(object, context);
     context.newLocation = computeLocationFromPaintInvalidationBacking(object, context);
 
     IntSize adjustment = object.scrollAdjustmentForPaintInvalidation(*context.paintInvalidationContainer);
     context.newLocation.move(adjustment);
     context.newBounds.move(adjustment);
@@ skipping 100 matching lines @@
     object.getMutableForPainting().clearPaintInvalidationFlags();
 }
 
 void PaintInvalidator::processPendingDelayedPaintInvalidations()
 {
     for (auto target : m_pendingDelayedPaintInvalidations)
         target->getMutableForPainting().setShouldDoFullPaintInvalidation(PaintInvalidationDelayedFull);
 }
 
 } // namespace blink