Account for perspective and preserve-3d in mapToVisualRectInAncestorSpace

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

Index: third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
diff --git a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
index a1a395249ffb86affc62651aae984b2faebcf49c..529cf94c44cb6a3e29b2064e1c2f86bff184cee5 100644
--- a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
+++ b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
@@ -499,11 +499,17 @@ static void slowMapToVisualRectInAncestorSpace(
   if (object.isBox())
     toLayoutBox(&object)->flipForWritingMode(rect);
 
-  if (object.isLayoutView())
-    toLayoutView(object).mapToVisualRectInAncestorSpace(
-        &ancestor, rect, InputIsInFrameCoordinates, DefaultVisualRectFlags);
-  else
+  if (object.isLayoutView()) {
+    TransformState transformState(TransformState::ApplyTransformDirection,
+                                  FloatQuad(FloatRect(rect)));
+    toLayoutView(object).mapToVisualRectInAncestorSpaceInternal(
+        &ancestor, transformState, InputIsInFrameCoordinates,
+        DefaultVisualRectFlags);
+    transformState.flatten();
+    rect = LayoutRect(transformState.lastPlanarQuad().boundingBox());
+  } else {
     object.mapToVisualRectInAncestorSpace(&ancestor, rect);
+  }
 }
 
 void PaintInvalidationState::mapLocalRectToPaintInvalidationContainer(