[SPInvalidation] Fix paint offset issue of descendants of composited svg root

third_party/WebKit/Source/core/paint/PaintInvalidator.cpp

Index: third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp b/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
index c250cac23558cf24e557f35ddb5115e285b29ca3..879ec10c56c36afd5282b6ce7290b41b9808f5c1 100644
--- a/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
@@ -73,12 +73,15 @@ static LayoutRect mapLocalRectToPaintInvalidationBacking(GeometryMapper& geometr
         GeometryPropertyTreeState currentTreeState(context.treeBuilderContext.current.transform, context.treeBuilderContext.current.clip, context.treeBuilderContext.currentEffect);
         GeometryPropertyTreeState containerTreeState;
         const ObjectPaintProperties* containerPaintProperties = context.paintInvalidationContainer->objectPaintProperties();
-        containerPaintProperties->getContentsProperties(containerTreeState);
+        LayoutPoint paintOffsetFromContainerTreeState;
+        containerPaintProperties->getContentsPropertyTreeState(containerTreeState, paintOffsetFromContainerTreeState);
 
         bool success = false;
         result = LayoutRect(geometryMapper.mapToVisualRectInDestinationSpace(rect, currentTreeState, containerTreeState, success));
         DCHECK(success);
-        result.moveBy(-containerPaintProperties->localBorderBoxProperties()->paintOffset);
+
+        // Convert the result from containerTreeState space to the container's contents space.
+        result.moveBy(-paintOffsetFromContainerTreeState);
     }
 
     if (context.paintInvalidationContainer->layer()->groupedMapping())
@@ -114,12 +117,17 @@ LayoutPoint PaintInvalidator::computeLocationFromPaintInvalidationBacking(const
     if (object != context.paintInvalidationContainer) {
         point.moveBy(FloatPoint(context.treeBuilderContext.current.paintOffset));
 
-        bool success = false;
         GeometryPropertyTreeState currentTreeState(context.treeBuilderContext.current.transform, context.treeBuilderContext.current.clip, context.treeBuilderContext.currentEffect);
         GeometryPropertyTreeState containerTreeState;
-        context.paintInvalidationContainer->objectPaintProperties()->getContentsProperties(containerTreeState);
+        LayoutPoint paintOffsetFromContainerTreeState;
+        context.paintInvalidationContainer->objectPaintProperties()->getContentsPropertyTreeState(containerTreeState, paintOffsetFromContainerTreeState);
+
+        bool success = false;
         point = m_geometryMapper.mapRectToDestinationSpace(FloatRect(point, FloatSize()), currentTreeState, containerTreeState, success).location();
         DCHECK(success);
+
+        // Convert the result from containerTreeState space to the container's contents space.
+        point.moveBy(-paintOffsetFromContainerTreeState);
     }
 
     if (context.paintInvalidationContainer->layer()->groupedMapping())