Revert of Avoid special handling of LayoutSVGForeignObject about its paint offset

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintPropertyTreeBuilder.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 248 matching lines @@
       floatValueForLength(style.transformOriginY(), borderBoxSize.height()),
       style.transformOriginZ());
 }
 
 // SVG does not use the general transform update of |updateTransform|, instead
 // creating a transform node for SVG-specific transforms without 3D.
 void PaintPropertyTreeBuilder::updateTransformForNonRootSVG(
     const LayoutObject& object,
     PaintPropertyTreeBuilderContext& context) {
   DCHECK(object.isSVG() && !object.isSVGRoot());
-  // SVG does not use paint offset internally.
-  DCHECK(context.current.paintOffset == LayoutPoint());
+  // SVG (other than SVGForeignObject) does not use paint offset internally.
+  DCHECK(object.isSVGForeignObject() ||
+         context.current.paintOffset == LayoutPoint());
 
   if (object.needsPaintPropertyUpdate()) {
-    const AffineTransform& transform = object.localToSVGParentTransform();
+    // TODO(pdr): Refactor this so all non-root SVG objects use the same
+    // transform function.
+    const AffineTransform& transform = object.isSVGForeignObject()
+                                           ? object.localSVGTransform()
+                                           : object.localToSVGParentTransform();
     // TODO(pdr): Check for the presence of a transform instead of the value.
     // Checking for an identity matrix will cause the property tree structure
     // to change during animations if the animation passes through the
     // identity matrix.
     if (!transform.isIdentity()) {
       // The origin is included in the local transform, so leave origin empty.
       object.getMutableForPainting().ensurePaintProperties().updateTransform(
           context.current.transform, TransformationMatrix(transform),
           FloatPoint3D());
     } else {
@@ skipping 549 matching lines @@
         overrideContaineringBlockContextFromRealContainingBlock(
             toLayoutBlock(*boxModelObject.container()), context.current);
       } else {
         context.current = context.fixedPosition;
       }
       break;
     default:
       ASSERT_NOT_REACHED();
   }
 
+  // SVGForeignObject needs paint offset because its viewport offset is baked
+  // into its location(), while its localSVGTransform() doesn't contain the
+  // offset.
   if (boxModelObject.isBox() &&
-      (!boxModelObject.isSVG() || boxModelObject.isSVGRoot())) {
+      (!boxModelObject.isSVG() || boxModelObject.isSVGRoot() ||
+       boxModelObject.isSVGForeignObject())) {
     // TODO(pdr): Several calls in this function walk back up the tree to
     // calculate containers (e.g., topLeftLocation, offsetForInFlowPosition*).
     // The containing block and other containers can be stored on
     // PaintPropertyTreeBuilderContext instead of recomputing them.
     context.current.paintOffset.moveBy(
         toLayoutBox(boxModelObject).topLeftLocation());
     // This is a weird quirk that table cells paint as children of table rows,
     // but their location have the row's location baked-in.
     // Similar adjustment is done in LayoutTableCell::offsetFromContainer().
     if (boxModelObject.isTableCell()) {
@@ skipping 36 matching lines @@
 #endif
 
   updateOverflowClip(object, context);
   updatePerspective(object, context);
   updateSvgLocalToBorderBoxTransform(object, context);
   updateScrollAndScrollTranslation(object, context);
   updateOutOfFlowContext(object, context);
 }
 
 }  // namespace blink