Revert of Avoid special handling of LayoutSVGForeignObject about its paint offset

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

Index: third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
index b903dbe5ca502038f08d48e03dd118bf05bb148d..74bae4548d574c54e93fd836044f0d74cf80b4ab 100644
--- a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
@@ -266,11 +266,16 @@ void PaintPropertyTreeBuilder::updateTransformForNonRootSVG(
     const LayoutObject& object,
     PaintPropertyTreeBuilderContext& context) {
   DCHECK(object.isSVG() && !object.isSVGRoot());
-  // SVG does not use paint offset internally.
-  DCHECK(context.current.paintOffset == LayoutPoint());
+  // SVG (other than SVGForeignObject) does not use paint offset internally.
+  DCHECK(object.isSVGForeignObject() ||
+         context.current.paintOffset == LayoutPoint());
 
   if (object.needsPaintPropertyUpdate()) {
-    const AffineTransform& transform = object.localToSVGParentTransform();
+    // TODO(pdr): Refactor this so all non-root SVG objects use the same
+    // transform function.
+    const AffineTransform& transform = object.isSVGForeignObject()
+                                           ? object.localSVGTransform()
+                                           : object.localToSVGParentTransform();
     // TODO(pdr): Check for the presence of a transform instead of the value.
     // Checking for an identity matrix will cause the property tree structure
     // to change during animations if the animation passes through the
@@ -840,8 +845,12 @@ static void deriveBorderBoxFromContainerContext(
       ASSERT_NOT_REACHED();
   }
 
+  // SVGForeignObject needs paint offset because its viewport offset is baked
+  // into its location(), while its localSVGTransform() doesn't contain the
+  // offset.
   if (boxModelObject.isBox() &&
-      (!boxModelObject.isSVG() || boxModelObject.isSVGRoot())) {
+      (!boxModelObject.isSVG() || boxModelObject.isSVGRoot() ||
+       boxModelObject.isSVGForeignObject())) {
     // TODO(pdr): Several calls in this function walk back up the tree to
     // calculate containers (e.g., topLeftLocation, offsetForInFlowPosition*).
     // The containing block and other containers can be stored on