Allow paint invalidation containers to cross frame boundaries.

Source/core/rendering/RenderView.cpp

Index: Source/core/rendering/RenderView.cpp
diff --git a/Source/core/rendering/RenderView.cpp b/Source/core/rendering/RenderView.cpp
index 481d9e087ee2e28900e2cac7ab40a1c75f535a38..d8ad3e270635e16f62d41d8895f2dc72029bf8c9 100644
--- a/Source/core/rendering/RenderView.cpp
+++ b/Source/core/rendering/RenderView.cpp
@@ -285,10 +285,6 @@ void RenderView::mapLocalToContainer(const RenderLayerModelObject* repaintContai
             return;
         }
     }
-
-    // If a container was specified, and was not 0 or the RenderView,
-    // then we should have found it by now.
-    ASSERT_ARG(repaintContainer, !repaintContainer);
 }
 
 const RenderObject* RenderView::pushMappingToContainer(const RenderLayerModelObject* ancestorToStopAt, RenderGeometryMap& geometryMap) const
@@ -450,8 +446,12 @@ void RenderView::invalidateTreeIfNeeded(const PaintInvalidationState& paintInval
 
     // We specifically need to repaint the viewRect since other renderers
     // short-circuit on full-repaint.
-    if (doingFullPaintInvalidation() && !viewRect().isEmpty())
-        invalidatePaintForRectangle(viewRect());
+    LayoutRect dirtyRect = viewRect();
+    if (doingFullPaintInvalidation() && !dirtyRect.isEmpty()) {
+        const RenderLayerModelObject* paintInvalidationContainer = &paintInvalidationState.paintInvalidationContainer();
+        mapRectToPaintInvalidationBacking(paintInvalidationContainer, dirtyRect);
+        invalidatePaintUsingContainer(paintInvalidationContainer, dirtyRect, InvalidationFull);
+    }
 
     RenderBlock::invalidateTreeIfNeeded(paintInvalidationState);
 }
@@ -463,24 +463,12 @@ void RenderView::invalidatePaintForRectangle(const LayoutRect& paintInvalidation
     if (document().printing() || !m_frameView)
         return;
 
-    // We always just invalidate the root view, since we could be an iframe that is clipped out
-    // or even invisible.
-    Element* owner = document().ownerElement();
+    ASSERT(layer()->compositingState() == PaintsIntoOwnBacking || !document().ownerElement());
+
     if (layer()->compositingState() == PaintsIntoOwnBacking) {
         layer()->repainter().setBackingNeedsRepaintInRect(paintInvalidationRect);
-    } else if (!owner) {
+    } else {
         m_frameView->contentRectangleForPaintInvalidation(pixelSnappedIntRect(paintInvalidationRect));
-    } else if (RenderBox* obj = owner->renderBox()) {
-        // Intersect the viewport with the paint invalidation rect.
-        LayoutRect viewRectangle = viewRect();
-        LayoutRect rectToInvalidate = intersection(paintInvalidationRect, viewRectangle);
-
-        // Adjust for scroll offset of the view.
-        rectToInvalidate.moveBy(-viewRectangle.location());
-
-        // Adjust for frame border.
-        rectToInvalidate.moveBy(obj->contentBoxRect().location());
-        obj->invalidatePaintRectangle(rectToInvalidate);
     }
 }
 
@@ -497,10 +485,6 @@ void RenderView::invalidatePaintForViewAndCompositedLayers()
 
 void RenderView::mapRectToPaintInvalidationBacking(const RenderLayerModelObject* paintInvalidationContainer, LayoutRect& rect, bool fixed, const PaintInvalidationState* paintInvalidationState) const
 {
-    // If a container was specified, and was not 0 or the RenderView,
-    // then we should have found it by now.
-    ASSERT_ARG(paintInvalidationContainer, !paintInvalidationContainer || paintInvalidationContainer == this);
-
     if (document().printing())
         return;
 
@@ -524,6 +508,25 @@ void RenderView::mapRectToPaintInvalidationBacking(const RenderLayerModelObject*
     // Apply our transform if we have one (because of full page zooming).
     if (!paintInvalidationContainer && layer() && layer()->transform())
         rect = layer()->transform()->mapRect(rect);
+
+    if (!paintInvalidationContainer || paintInvalidationContainer == this)

[leviw_travelin_and_unemployed, 2014/08/06 22:04:32]

What's the case where paintInvalidationContainer is null here? Can we make that
case go away?

[chrishtr, 2014/08/06 22:54:20]

I don't think there is one. Fixed and added ASSERT(). 
RenderObject::adjustCompositedContainerForSpecialAncestors() has special code to
return view() if
the paintInvalidationContainer is 0. I'll try in another patch to unify that
logic into
RenderLayer::enclosingLayerForPaintInvalidationCrossingFrameBoundaries()
also.

[philipj_slow, 2014/08/28 14:02:28]

There is such a case in RenderObject::selectionRect(), which simply passes 0 for
the paintInvalidationContainer which eventually ends up here and fails the
assert:
https://code.google.com/p/chromium/issues/detail?id=408495

+        return;
+
+    Element* owner = document().ownerElement();
+    if (!owner)
+        return;
+    if (RenderBox* obj = owner->renderBox()) {
+        // Intersect the viewport with the paint invalidation rect.
+        LayoutRect viewRectangle = viewRect();
+        rect.intersect(viewRectangle);
+
+        // Adjust for scroll offset of the view.
+        rect.moveBy(-viewRectangle.location());
+
+        // Adjust for frame border.
+        rect.moveBy(obj->contentBoxRect().location());
+        obj->mapRectToPaintInvalidationBacking(paintInvalidationContainer, rect);
+    }
 }
 
 void RenderView::absoluteRects(Vector<IntRect>& rects, const LayoutPoint& accumulatedOffset) const