Apply both phsical bounding box and clip to composited bounds.

third_party/WebKit/Source/core/paint/PaintLayer.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights
  * reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
@@ skipping 2533 matching lines @@
   // The layer created for the LayoutFlowThread is just a helper for painting
   // and hit-testing, and should not contribute to the bounding box. The
   // LayoutMultiColumnSets will contribute the correct size for the layout
   // content of the multicol container.
   if (layoutObject()->isLayoutFlowThread())
     return LayoutRect();
 
   const_cast<PaintLayer*>(this)->stackingNode()->updateLayerListsIfNeeded();
 
   // If there is a clip applied by an ancestor to this PaintLayer but below or
-  // equal to |ancestorLayer|, use that clip as the bounds rather than the
-  // recursive bounding boxes, since the latter may be larger than the actual
-  // size. See https://bugs.webkit.org/show_bug.cgi?id=80372 for examples.
+  // equal to |ancestorLayer|, apply that clip.
   LayoutRect result = clipper().localClipRect(compositedLayer);
-  // TODO(chrishtr): avoid converting to IntRect and back.
-  if (result == LayoutRect(LayoutRect::infiniteIntRect()))
-    result = physicalBoundingBox(LayoutPoint());
+
+  result.intersect(physicalBoundingBox(LayoutPoint()));
 
   expandRectForStackingChildren(compositedLayer, result, options);
 
   // Only enlarge by the filter outsets if we know the filter is going to be
   // rendered in software.  Accelerated filters will handle their own outsets.
   if (paintsWithFilters())
     result = mapLayoutRectForFilter(result);
 
   if (transform() && (options == IncludeTransformsAndCompositedChildLayers ||
                       ((paintsWithTransform(GlobalPaintNormalPhase) &&
                         (this != compositedLayer ||
                          options == MaybeIncludeTransformForAncestorLayer)))))
     result = transform()->mapRect(result);

[chrishtr, 2016/12/28 23:56:38]

Before this patch, the input to this mapRect call could be larger than the
physical size of the PaintLayer and its descendants.

[Xianzhu, 2016/12/29 00:09:01]

How does the larger rect cause wrong position of the highlight?

[chrishtr, 2016/12/29 01:08:35]

The entire graphics layer has an incorrect offsetFromLayoutObject.

 
   if (shouldFragmentCompositedBounds(compositedLayer)) {
     convertFromFlowThreadToVisualBoundingBoxInAncestor(compositedLayer, result);
     return result;
   }
 
   if (stackingParent) {
     LayoutPoint delta;
     convertToLayerCoords(stackingParent, delta);
     result.moveBy(delta);
@@ skipping 667 matching lines @@
 }
 
 void showLayerTree(const blink::LayoutObject* layoutObject) {
   if (!layoutObject) {
     LOG(INFO) << "Cannot showLayerTree. Root is (nil)";
     return;
   }
   showLayerTree(layoutObject->enclosingLayer());
 }
 #endif