Allow paint invalidation containers to cross frame boundaries.

Source/core/rendering/RenderView.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 267 matching lines @@
 
     if (mode & TraverseDocumentBoundaries) {
         if (RenderObject* parentDocRenderer = frame()->ownerRenderer()) {
             transformState.move(-frame()->view()->scrollOffset());
             if (parentDocRenderer->isBox())
                 transformState.move(toLayoutSize(toRenderBox(parentDocRenderer)->contentBoxRect().location()));
             parentDocRenderer->mapLocalToContainer(repaintContainer, transformState, mode, wasFixed, paintInvalidationState);
             return;
         }
     }
-
-    // If a container was specified, and was not 0 or the RenderView,
-    // then we should have found it by now.
-    ASSERT_ARG(repaintContainer, !repaintContainer);
 }
 
 const RenderObject* RenderView::pushMappingToContainer(const RenderLayerModelObject* ancestorToStopAt, RenderGeometryMap& geometryMap) const
 {
     LayoutSize offsetForFixedPosition;
     LayoutSize offset;
     RenderObject* container = 0;
 
     if (m_frameView)
         offsetForFixedPosition = m_frameView->scrollOffsetForFixedPosition();
@@ skipping 141 matching lines @@
         }
     }
 }
 
 void RenderView::invalidateTreeIfNeeded(const PaintInvalidationState& paintInvalidationState)
 {
     ASSERT(!needsLayout());
 
     // We specifically need to repaint the viewRect since other renderers
     // short-circuit on full-repaint.
-    if (doingFullPaintInvalidation() && !viewRect().isEmpty())
-        invalidatePaintForRectangle(viewRect());
+    LayoutRect dirtyRect = viewRect();
+    if (doingFullPaintInvalidation() && !dirtyRect.isEmpty()) {
+        const RenderLayerModelObject* paintInvalidationContainer = &paintInvalidationState.paintInvalidationContainer();
+        mapRectToPaintInvalidationBacking(paintInvalidationContainer, dirtyRect);
+        invalidatePaintUsingContainer(paintInvalidationContainer, dirtyRect, InvalidationFull);
+    }
 
     RenderBlock::invalidateTreeIfNeeded(paintInvalidationState);
 }
 
 void RenderView::invalidatePaintForRectangle(const LayoutRect& paintInvalidationRect) const
 {
     ASSERT(!paintInvalidationRect.isEmpty());
 
     if (document().printing() || !m_frameView)
         return;
 
-    // We always just invalidate the root view, since we could be an iframe that is clipped out
-    // or even invisible.
-    Element* owner = document().ownerElement();
+    ASSERT(layer()->compositingState() == PaintsIntoOwnBacking || !document().ownerElement());
+
     if (layer()->compositingState() == PaintsIntoOwnBacking) {
         layer()->repainter().setBackingNeedsRepaintInRect(paintInvalidationRect);
-    } else if (!owner) {
+    } else {
         m_frameView->contentRectangleForPaintInvalidation(pixelSnappedIntRect(paintInvalidationRect));
-    } else if (RenderBox* obj = owner->renderBox()) {
-        // Intersect the viewport with the paint invalidation rect.
-        LayoutRect viewRectangle = viewRect();
-        LayoutRect rectToInvalidate = intersection(paintInvalidationRect, viewRectangle);
-
-        // Adjust for scroll offset of the view.
-        rectToInvalidate.moveBy(-viewRectangle.location());
-
-        // Adjust for frame border.
-        rectToInvalidate.moveBy(obj->contentBoxRect().location());
-        obj->invalidatePaintRectangle(rectToInvalidate);
     }
 }
 
 void RenderView::invalidatePaintForViewAndCompositedLayers()
 {
     paintInvalidationForWholeRenderer();
 
     // The only way we know how to hit these ASSERTS below this point is via the Chromium OS login screen.
     DisableCompositingQueryAsserts disabler;
 
     if (compositor()->inCompositingMode())
         compositor()->fullyInvalidatePaint();
 }
 
 void RenderView::mapRectToPaintInvalidationBacking(const RenderLayerModelObject* paintInvalidationContainer, LayoutRect& rect, bool fixed, const PaintInvalidationState* paintInvalidationState) const
 {
-    // If a container was specified, and was not 0 or the RenderView,
-    // then we should have found it by now.
-    ASSERT_ARG(paintInvalidationContainer, !paintInvalidationContainer || paintInvalidationContainer == this);
-
     if (document().printing())
         return;
 
     if (style()->isFlippedBlocksWritingMode()) {
         // We have to flip by hand since the view's logical height has not been determined.  We
         // can use the viewport width and height.
         if (style()->isHorizontalWritingMode())
             rect.setY(viewHeight() - rect.maxY());
         else
             rect.setX(viewWidth() - rect.maxX());
     }
 
     if (fixed && m_frameView) {
         rect.move(m_frameView->scrollOffsetForFixedPosition());
         // If we have a pending scroll, invalidate the previous scroll position.
         if (!m_frameView->pendingScrollDelta().isZero()) {
             rect.move(-m_frameView->pendingScrollDelta());
         }
     }
 
     // Apply our transform if we have one (because of full page zooming).
     if (!paintInvalidationContainer && layer() && layer()->transform())
         rect = layer()->transform()->mapRect(rect);
+
+    if (!paintInvalidationContainer || paintInvalidationContainer == this)

[leviw_travelin_and_unemployed, 2014/08/06 22:04:32]

What's the case where paintInvalidationContainer is null here? Can we make that
case go away?

[chrishtr, 2014/08/06 22:54:20]

I don't think there is one. Fixed and added ASSERT(). 
RenderObject::adjustCompositedContainerForSpecialAncestors() has special code to
return view() if
the paintInvalidationContainer is 0. I'll try in another patch to unify that
logic into
RenderLayer::enclosingLayerForPaintInvalidationCrossingFrameBoundaries()
also.

[philipj_slow, 2014/08/28 14:02:28]

There is such a case in RenderObject::selectionRect(), which simply passes 0 for
the paintInvalidationContainer which eventually ends up here and fails the
assert:
https://code.google.com/p/chromium/issues/detail?id=408495

+        return;
+
+    Element* owner = document().ownerElement();
+    if (!owner)
+        return;
+    if (RenderBox* obj = owner->renderBox()) {
+        // Intersect the viewport with the paint invalidation rect.
+        LayoutRect viewRectangle = viewRect();
+        rect.intersect(viewRectangle);
+
+        // Adjust for scroll offset of the view.
+        rect.moveBy(-viewRectangle.location());
+
+        // Adjust for frame border.
+        rect.moveBy(obj->contentBoxRect().location());
+        obj->mapRectToPaintInvalidationBacking(paintInvalidationContainer, rect);
+    }
 }
 
 void RenderView::absoluteRects(Vector<IntRect>& rects, const LayoutPoint& accumulatedOffset) const
 {
     rects.append(pixelSnappedIntRect(accumulatedOffset, layer()->size()));
 }
 
 void RenderView::absoluteQuads(Vector<FloatQuad>& quads, bool* wasFixed) const
 {
     if (wasFixed)
@@ skipping 456 matching lines @@
     return viewWidth(IncludeScrollbars) / scale;
 }
 
 double RenderView::layoutViewportHeight() const
 {
     float scale = m_frameView ? m_frameView->frame().pageZoomFactor() : 1;
     return viewHeight(IncludeScrollbars) / scale;
 }
 
 } // namespace blink