Avoid double paint offset of SVGForeignObject visual rect

third_party/WebKit/Source/core/paint/PaintInvalidator.cpp

Index: third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp b/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
index 9982e8a03fa82f724ad7bf3b25c33e0bfe9c0ef2..16d3f4c0419858cce1c81f34b2bdf2e41ddb3c06 100644
--- a/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
@@ -71,7 +71,10 @@ static LayoutRect mapLocalRectToPaintInvalidationBacking(
 
   if (RuntimeEnabledFeatures::slimmingPaintV2Enabled()) {
     // In SPv2, visual rects are in the space of their local transform node.
-    rect.moveBy(FloatPoint(context.treeBuilderContext.current.paintOffset));
+    // For SVG, the input rect is in local SVG coordinates in which paint
+    // offset doesn't apply.
+    if (!object.isSVG() || object.isSVGRoot())
+      rect.moveBy(FloatPoint(context.treeBuilderContext.current.paintOffset));
     // Use enclosingIntRect to ensure the final visual rect will cover the
     // rect in source coordinates no matter if the painting will use pixel
     // snapping.
@@ -86,8 +89,10 @@ static LayoutRect mapLocalRectToPaintInvalidationBacking(
   } else if (object == context.paintInvalidationContainer) {
     result = LayoutRect(rect);
   } else {
-    rect.moveBy(FloatPoint(context.treeBuilderContext.current.paintOffset));
-    if ((!object.isSVG() || object.isSVGRoot()) && !rect.isEmpty()) {
+    // For non-root SVG, the input rect is in local SVG coordinates in which
+    // paint offset doesn't apply.
+    if (!object.isSVG() || object.isSVGRoot()) {
+      rect.moveBy(FloatPoint(context.treeBuilderContext.current.paintOffset));
       // Use enclosingIntRect to ensure the final visual rect will cover the
       // rect in source coordinates no matter if the painting will use pixel
       // snapping.