Output svg foreign object paint offset in paint properties

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintPropertyTreeBuilder.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 200 matching lines @@
     FloatSize borderBoxSize(box.size());
     return FloatPoint3D(
         floatValueForLength(style.transformOriginX(), borderBoxSize.width()),
         floatValueForLength(style.transformOriginY(), borderBoxSize.height()),
         style.transformOriginZ());
 }
 
 void PaintPropertyTreeBuilder::updateTransform(const LayoutObject& object, PaintPropertyTreeBuilderContext& context)
 {
     if (object.isSVG() && !object.isSVGRoot()) {
-        // SVG does not use paint offset internally.
-        DCHECK(context.current.paintOffset == LayoutPoint());
+        // SVG (other than SVGForeignObject) does not use paint offset internally.
+        DCHECK(object.isSVGForeignObject() || context.current.paintOffset == LayoutPoint());
 
         // FIXME(pdr): Check for the presence of a transform instead of the value. Checking for an
         // identity matrix will cause the property tree structure to change during animations if
         // the animation passes through the identity matrix.
         // FIXME(pdr): Refactor this so all non-root SVG objects use the same transform function.
         const AffineTransform& transform = object.isSVGForeignObject() ? object.localSVGTransform() : object.localToSVGParentTransform();
         if (!transform.isIdentity()) {
             // The origin is included in the local transform, so leave origin empty.
             context.current.transform = object.getMutableForPainting().ensureObjectPaintProperties().createOrUpdateTransform(
                 context.current.transform, TransformationMatrix(transform), FloatPoint3D());
@@ skipping 301 matching lines @@
     }
     case StickyPosition:
         context.current.paintOffset += boxModelObject.offsetForInFlowPosition();
         break;
     case FixedPosition:
         context.current = context.fixedPosition;
         break;
     default:
         ASSERT_NOT_REACHED();
     }
-    if (boxModelObject.isBox() && (!boxModelObject.isSVG() || boxModelObject.isSVGRoot())) {
+
+    // SVGForeignObject needs paint offset because its viewport offset is baked into its location(),
+    // while its localSVGTransform() doesn't contain the offset.
+    if (boxModelObject.isBox() && (!boxModelObject.isSVG() || boxModelObject.isSVGRoot() || boxModelObject.isSVGForeignObject())) {
         // TODO(pdr): Several calls in this function walk back up the tree to calculate containers
         // (e.g., topLeftLocation, offsetForInFlowPosition*). The containing block and other
         // containers can be stored on PaintPropertyTreeBuilderContext instead of recomputing them.
         context.current.paintOffset.moveBy(toLayoutBox(boxModelObject).topLeftLocation());
         // This is a weird quirk that table cells paint as children of table rows,
         // but their location have the row's location baked-in.
         // Similar adjustment is done in LayoutTableCell::offsetFromContainer().
         if (boxModelObject.isTableCell()) {
             LayoutObject* parentRow = boxModelObject.parent();
             ASSERT(parentRow && parentRow->isTableRow());
@@ skipping 24 matching lines @@
         return;
 
     updateOverflowClip(object, context);
     updatePerspective(object, context);
     updateSvgLocalToBorderBoxTransform(object, context);
     updateScrollAndScrollTranslation(object, context);
     updateOutOfFlowContext(object, context);
 }
 
 } // namespace blink