Fix paint invalidation for composited vertical-rl having overflow

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/PaintInvalidationState.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 400 matching lines @@
     if (m_paintInvalidationContainer->layer()->groupedMapping())
         PaintLayer::mapRectInPaintInvalidationContainerToBacking(*m_paintInvalidationContainer, rect);
     return rect;
 }
 
 static void slowMapToVisualRectInAncestorSpace(const LayoutObject& object, const LayoutBoxModelObject& ancestor, LayoutRect& rect)
 {
     // TODO(wkorman): The flip below is required because visual rects are
     // currently in "physical coordinates with flipped block-flow direction"
     // (see LayoutBoxModelObject.h) but we need them to be in physical
-    // coordinates. When we're mapping within exactly one object we keep the
-    // input rect flipped because we'd just have to re-flip in short order, as
-    // the output of this method must be in the "physical coordinates with
-    // flipped block-flow direction.
-    if (object.isBox() && object != ancestor)

[chrishtr, 2016/09/27 00:02:43]

Is there an existing test that this is not needed for boxes that are not
LayoutViews? I agree with your 
logical argument, but we did debug for a while and concluded this was correct...
:(

[Xianzhu, 2016/09/27 00:26:45]

There seems no existing test. The added test
paint/invalidation/composited-vertical-rl-overflow.html can reproduce the bug.
The key is unsymmetrical left and right overflows.

I also didn't notice the issue when the the above code was added. Just noticed
it when I was trying to fix the flipping issue for slimmingPaintInvalidation on
spv1. 

+    // coordinates.
+    if (object.isBox())
         toLayoutBox(&object)->flipForWritingMode(rect);
 
     if (object.isLayoutView())
         toLayoutView(object).mapToVisualRectInAncestorSpace(&ancestor, rect, InputIsInFrameCoordinates, DefaultVisualRectFlags);
     else
         object.mapToVisualRectInAncestorSpace(&ancestor, rect);
 }
 
 void PaintInvalidationState::mapLocalRectToPaintInvalidationContainer(LayoutRect& rect) const
 {
@@ skipping 111 matching lines @@
 }
 
 
 void PaintInvalidatorContextAdapter::mapLocalRectToPaintInvalidationBacking(const LayoutObject& object, LayoutRect& rect) const
 {
     DCHECK(&object == &m_paintInvalidationState.currentObject());
     m_paintInvalidationState.mapLocalRectToPaintInvalidationBacking(rect);
 }
 
 } // namespace blink