Expand PaintLayer clip to account for hidden URL bar with document.rootScroller

third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp

Index: third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp b/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp
index 7f5ee0603bddc1e2d0e6ecd9d09976dbda872af1..79f5f911773ed0ccbd9040830da2e63f2d0b0741 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp
@@ -330,10 +330,9 @@ void PaintLayerClipper::calculateRects(
     return;
   }
 
-  bool isClippingRoot = &m_layer == context.rootLayer;
   LayoutBoxModelObject& layoutObject = *m_layer.layoutObject();
 
-  if (!isClippingRoot && m_layer.parent()) {
+  if (!isClippingRoot(context) && m_layer.parent()) {
     backgroundRect = backgroundClipRect(context);
     backgroundRect.move(context.subPixelAccumulation);
     backgroundRect.intersect(paintDirtyRect);
@@ -361,11 +360,13 @@ void PaintLayerClipper::calculateRects(
     // FIXME: Does not do the right thing with columns yet, since we don't yet
     // factor in the individual column boxes as overflow.
 
-    // The LayoutView is special since its overflow clipping rect may be larger
-    // than its box rect (crbug.com/492871).
+    // The RootScroller (typically LayoutView) is special since its overflow
+    // clipping rect may be larger than its box rect (crbug.com/492871).
+    DCHECK(!m_layer.isRootScrollerLayer() ||
+           layoutObject.document().topDocument().layoutView());
     LayoutRect layerBoundsWithVisualOverflow =
-        layoutObject.isLayoutView()
-            ? toLayoutView(layoutObject).viewRect()
+        m_layer.isRootScrollerLayer()
+            ? layoutObject.document().topDocument().layoutView()->viewRect()
             : toLayoutBox(layoutObject).visualOverflowRect();
     // PaintLayer are in physical coordinates, so the overflow has to be
     // flipped.
@@ -396,12 +397,11 @@ void PaintLayerClipper::calculateClipRects(const ClipRectsContext& context,
     return;
   }
 
-  bool isClippingRoot = &m_layer == context.rootLayer;
-
   // For transformed layers, the root layer was shifted to be us, so there is no
   // need to examine the parent. We want to cache clip rects with us as the
   // root.
-  PaintLayer* parentLayer = !isClippingRoot ? m_layer.parent() : nullptr;
+  PaintLayer* parentLayer =
+      !isClippingRoot(context) ? m_layer.parent() : nullptr;
   // Ensure that our parent's clip has been calculated so that we can examine
   // the values.
   if (parentLayer) {
@@ -499,6 +499,10 @@ ClipRect PaintLayerClipper::applyOverflowClipToBackgroundRectWithGeometryMapper(
   return ClipRect(LayoutRect(clipRect));
 }
 
+bool PaintLayerClipper::isClippingRoot(const ClipRectsContext& context) const {
+  return &m_layer == context.rootLayer || m_layer.isRootScrollerLayer();
+}
+
 ClipRect PaintLayerClipper::backgroundClipRect(
     const ClipRectsContext& context) const {
   if (m_geometryMapper) {