Issue paint offset for SVGText, etc.

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

Index: third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
index 2ca46226fd107407f6a2125a858841a3d2dd0040..215f0ff67a9b0c5bcde1bf147ed87862a2e2b0d9 100644
--- a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
@@ -262,11 +262,15 @@ void PaintPropertyTreeBuilder::updateTransformForNonRootSVG(
     const LayoutObject& object,
     PaintPropertyTreeBuilderContext& context) {
   DCHECK(object.isSVG() && !object.isSVGRoot());
-  // SVG (other than SVGForeignObject) does not use paint offset internally.
-  DCHECK(object.isSVGForeignObject() ||
+  // SVG does not use paint offset internally, except for those inheriting from
+  // LayoutBoxModelObject or LayoutText which will use HTML painters.
+  DCHECK(object.isBoxModelObject() || object.isText() ||
          context.current.paintOffset == LayoutPoint());
 
   if (object.needsPaintPropertyUpdate()) {
+    // SVGForeignObject issues paint offset using its location() which contains
+    // its viewport offset, so here we must use localSVGTransform() which does
+    // not contain the viewport offset, instead of localToSVGParentTransform().
     // TODO(pdr): Refactor this so all non-root SVG objects use the same
     // transform function.
     const AffineTransform& transform = object.isSVGForeignObject()
@@ -855,12 +859,10 @@ static void deriveBorderBoxFromContainerContext(
       ASSERT_NOT_REACHED();
   }
 
-  // SVGForeignObject needs paint offset because its viewport offset is baked
-  // into its location(), while its localSVGTransform() doesn't contain the
-  // offset.
-  if (boxModelObject.isBox() &&
-      (!boxModelObject.isSVG() || boxModelObject.isSVGRoot() ||
-       boxModelObject.isSVGForeignObject())) {
+  // The following condition also includes any SVG objects inheriting LayoutBox

[pdr., 2016/11/16 03:53:49]

Nit: ...inheriting [from] LayoutBox...

[Xianzhu, 2016/11/16 04:05:48]

Done.

+  // and using HTML painters which will offset the paint origin by the object's
+  // location().
+  if (boxModelObject.isBox()) {
     // TODO(pdr): Several calls in this function walk back up the tree to
     // calculate containers (e.g., topLeftLocation, offsetForInFlowPosition*).
     // The containing block and other containers can be stored on