Don't access DisplayItemClient::VisualRect() for cached display items.

third_party/WebKit/Source/platform/graphics/paint/DrawingDisplayItem.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "platform/graphics/paint/DrawingDisplayItem.h"
 
 #include "platform/graphics/GraphicsContext.h"
 #include "platform/graphics/paint/PaintCanvas.h"
 #include "public/platform/WebDisplayItemList.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "third_party/skia/include/core/SkCanvas.h"
 #include "third_party/skia/include/core/SkData.h"
 
 namespace blink {
 
 void DrawingDisplayItem::Replay(GraphicsContext& context) const {
   if (record_)
     context.DrawRecord(record_);
 }
 
 void DrawingDisplayItem::AppendToWebDisplayItemList(
-    const IntRect& visual_rect,
+    const LayoutSize& visual_rect_offset,
     WebDisplayItemList* list) const {
-  if (record_)
-    list->AppendDrawingItem(visual_rect, record_);
+  if (record_) {
+    // Convert visual rect into the GraphicsLayer's coordinate space.
+    LayoutRect visual_rect = VisualRect();
+    visual_rect.Move(-visual_rect_offset);
+    list->AppendDrawingItem(EnclosingIntRect(visual_rect), record_);
+  }
 }
 
 bool DrawingDisplayItem::DrawsContent() const {
   return record_.get();
 }
 
 int DrawingDisplayItem::NumberOfSlowPaths() const {
   return record_ ? record_->numSlowPaths() : 0;
 }
 
@@ skipping 71 matching lines @@
 
   if (RecordsEqual(record, other_record))
     return true;
 
   // Sometimes the client may produce different records for the same visual
   // result, which should be treated as equal.
   return BitmapsEqual(std::move(record), std::move(other_record));
 }
 
 }  // namespace blink