Fix another caret paint invalidation issue

third_party/WebKit/Source/core/editing/CaretDisplayItemClient.cpp

 /*
  * Copyright (C) 2004, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 115 matching lines @@
   if (!m_previousLayoutBlock) {
     m_previousLayoutBlock = m_layoutBlock;
     m_visualRectInPreviousLayoutBlock = m_visualRect;
   }
 
   LayoutBlock* newLayoutBlock = caretLayoutBlock(caretPosition.anchorNode());
   if (newLayoutBlock != m_layoutBlock) {
     if (m_layoutBlock)
       m_layoutBlock->setMayNeedPaintInvalidation();
     m_layoutBlock = newLayoutBlock;
-    if (newLayoutBlock)
+    m_visualRect = LayoutRect();
+    if (newLayoutBlock) {
       m_needsPaintInvalidation = true;
-    m_visualRect = LayoutRect();
+      if (newLayoutBlock == m_previousLayoutBlock) {
+        // The caret has disappeared and is reappearing in the same block,
+        // since the last paint invalidation. Set m_visualRect as if the caret
+        // has always been there as paint invalidation doesn't care about the
+        // intermediate changes.
+        m_visualRect = m_visualRectInPreviousLayoutBlock;
+      }
+    }
   }
 
   if (!newLayoutBlock) {
     m_color = Color();
     m_localRect = LayoutRect();
     return;
   }
 
   Color newColor;
   if (caretPosition.anchorNode()) {
@@ skipping 117 matching lines @@
 
 String CaretDisplayItemClient::debugName() const {
   return "Caret";
 }
 
 LayoutRect CaretDisplayItemClient::visualRect() const {
   return m_visualRect;
 }
 
 }  // namespace blink