Correct flip of paint invalidation rect in PaintInvalidator

third_party/WebKit/Source/core/paint/PaintInvalidator.cpp

Index: third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp b/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
index be05bd7667b0e4bc938904da9595020d0faa96d1..322afab0fad2479cdde5519be31d42c8ac06f830 100644
--- a/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
@@ -44,8 +44,13 @@ static LayoutRect mapLocalRectToPaintInvalidationBacking(GeometryMapper& geometr
     // (see LayoutBoxModelObject.h) but we need them to be in physical
     // coordinates.
     FloatRect rect = localRect;
-    if (object.isBox())
+    if (object.isBox()) {
         toLayoutBox(object).flipForWritingMode(rect);
+    } else if (!(context.forcedSubtreeInvalidationFlags & PaintInvalidatorContext::ForcedSubtreeSlowPathRect)) {
+        // For SPv2 and the GeometryMapper path, we need to convert the rect into physical coordinates
+        // before applying paint offset. TODO(wangxianzhu): Avoid containingBlock().

[chrishtr, 2016/09/27 21:12:44]

Add a sentence explicitly saying that mapToVisualRectInAncestorSpace requires
physical pixels for boxes, but the opposite for non-boxes,
which differs from SPv2/GeometryMapper. This explains line 49, which is about
whether mapToVisualRectInAncestorSpace will be called.

[Xianzhu, 2016/09/27 21:30:40]

Done.

+        object.containingBlock()->flipForWritingMode(rect);
+    }
 
     if (RuntimeEnabledFeatures::slimmingPaintV2Enabled()) {
         // In SPv2, visual rects are in the space of their local transform node.
@@ -190,8 +195,7 @@ void PaintInvalidator::updateContext(const LayoutObject& object, PaintInvalidato
 
     // TODO(crbug.com/637313): This is temporary before we support filters in paint property tree.
     // TODO(crbug.com/648274): This is a workaround for multi-column contents.
-    // TODO(crbug.com/648409): This is a workaround for inline contents in vertical-rl container.
-    if (object.hasFilterInducingProperty() || object.isLayoutFlowThread() || object.hasFlippedBlocksWritingMode())
+    if (object.hasFilterInducingProperty() || object.isLayoutFlowThread())
         context.forcedSubtreeInvalidationFlags |= PaintInvalidatorContext::ForcedSubtreeSlowPathRect;
 
     context.oldBounds = object.previousPaintInvalidationRect();