Fix clipping of squashed sibling layers with border radius masks

third_party/WebKit/Source/core/paint/PaintLayerPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintLayerPainter.h"
 
 #include "core/frame/LocalFrame.h"
 #include "core/layout/LayoutView.h"
 #include "core/paint/ClipPathClipper.h"
 #include "core/paint/FilterPainter.h"
@@ skipping 935 matching lines @@
     DisplayItem::Type clipType =
         DisplayItem::paintPhaseToClipLayerFragmentType(phase);
     LayerClipRecorder::BorderRadiusClippingRule clippingRule;
     switch (phase) {
       case PaintPhaseSelfBlockBackgroundOnly:  // Background painting will
                                                // handle clipping to self.
       case PaintPhaseSelfOutlineOnly:
       case PaintPhaseMask:  // Mask painting will handle clipping to self.
         clippingRule = LayerClipRecorder::DoNotIncludeSelfForBorderRadius;
         break;
+      case kPaintPhaseClippingMask:
+        if (paint_flags & kPaintLayerPaintingAncestorClippingMaskPhase) {
+          // The ancestor is the thing that needs to clip, so do not include
+          // this layer's clips.
+          clipping_rule = LayerClipRecorder::kDoNotIncludeSelfForBorderRadius;
+          break;
+        }
       default:
         clippingRule = LayerClipRecorder::IncludeSelfForBorderRadius;
         break;
     }
 
     // TODO(schenney): Nested border-radius clips are not applied to composited
     // children, probably due to an incorrect clipRoot.
     // https://bugs.chromium.org/p/chromium/issues/detail?id=672561
     clipRecorder.emplace(context, m_paintLayer.layoutObject(), clipType,
                          clipRect, paintingInfo.rootLayer,
@@ skipping 242 matching lines @@
           context, layoutObject, PaintPhaseClippingMask))
     return;
 
   IntRect snappedClipRect = pixelSnappedIntRect(clipRect.rect());
   LayoutObjectDrawingRecorder drawingRecorder(
       context, layoutObject, PaintPhaseClippingMask, snappedClipRect);
   context.fillRect(snappedClipRect, Color::black);
 }
 
 }  // namespace blink