Avoid double paint offset of SVGForeignObject visual rect

third_party/WebKit/Source/core/paint/PaintInvalidator.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintInvalidator.h"
 
 #include "core/editing/FrameSelection.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
@@ skipping 53 matching lines @@
       // (Otherwise we'll call mapToVisualrectInAncestorSpace() which requires
       // physical coordinates for boxes, but "physical coordinates with flipped
       // block-flow direction" for non-boxes for which we don't need to flip.)
       // TODO(wangxianzhu): Avoid containingBlock().
       object.containingBlock()->flipForWritingMode(rect);
     }
   }
 
   if (RuntimeEnabledFeatures::slimmingPaintV2Enabled()) {
     // In SPv2, visual rects are in the space of their local transform node.
-    rect.moveBy(FloatPoint(context.treeBuilderContext.current.paintOffset));
+    // For SVG, the input rect is in local SVG coordinates in which paint
+    // offset doesn't apply.
+    if (!object.isSVG() || object.isSVGRoot())
+      rect.moveBy(FloatPoint(context.treeBuilderContext.current.paintOffset));
     // Use enclosingIntRect to ensure the final visual rect will cover the
     // rect in source coordinates no matter if the painting will use pixel
     // snapping.
     return LayoutRect(enclosingIntRect(rect));
   }
 
   LayoutRect result;
   if (context.forcedSubtreeInvalidationFlags &
       PaintInvalidatorContext::ForcedSubtreeSlowPathRect) {
     result = slowMapToVisualRectInAncestorSpace(
         object, *context.paintInvalidationContainer, rect);
   } else if (object == context.paintInvalidationContainer) {
     result = LayoutRect(rect);
   } else {
-    rect.moveBy(FloatPoint(context.treeBuilderContext.current.paintOffset));
-    if ((!object.isSVG() || object.isSVGRoot()) && !rect.isEmpty()) {
+    // For non-root SVG, the input rect is in local SVG coordinates in which
+    // paint offset doesn't apply.
+    if (!object.isSVG() || object.isSVGRoot()) {
+      rect.moveBy(FloatPoint(context.treeBuilderContext.current.paintOffset));
       // Use enclosingIntRect to ensure the final visual rect will cover the
       // rect in source coordinates no matter if the painting will use pixel
       // snapping.
       rect = enclosingIntRect(rect);
     }
 
     PropertyTreeState currentTreeState(
         context.treeBuilderContext.current.transform,
         context.treeBuilderContext.current.clip,
         context.treeBuilderContext.currentEffect,
@@ skipping 332 matching lines @@
         PaintInvalidatorContext::ForcedSubtreeInvalidationRectUpdate;
 }
 
 void PaintInvalidator::processPendingDelayedPaintInvalidations() {
   for (auto target : m_pendingDelayedPaintInvalidations)
     target->getMutableForPainting().setShouldDoFullPaintInvalidation(
         PaintInvalidationDelayedFull);
 }
 
 }  // namespace blink