[SPv2] Fix paint offset computation for LayoutTableCell in property tree builder

The table cells have a weird quirk. Although their layout container is the row,
are painted by the rows and can be affected by transforms on the row,
their layout location is relative to the table section.
(i.e. with the row's location baked-in)

This CL adjusts table cell's paint offset in property tree builder in the
same way as other layout/paint code does.

BUG=593525

Review URL: https://codereview.chromium.org/1805283002

Cr-Commit-Position: refs/heads/master@{#381397}

2 files changed, 50 insertions, 2 deletions

diff --git a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
index 20b4402..e19a8a7 100644
--- a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
@@ -107,7 +107,6 @@ static void deriveBorderBoxFromContainerContext(const LayoutObject& object, Pain
 
     const LayoutBoxModelObject& boxModelObject = toLayoutBoxModelObject(object);
 
-    // TODO(trchen): There is some insanity going on with tables. Double check results.
     switch (object.styleRef().position()) {
     case StaticPosition:
         break;
@@ -130,8 +129,17 @@ static void deriveBorderBoxFromContainerContext(const LayoutObject& object, Pain
     default:
         ASSERT_NOT_REACHED();
     }
-    if (boxModelObject.isBox())
+    if (boxModelObject.isBox()) {
         context.paintOffset += toLayoutBox(boxModelObject).locationOffset();
+        // This is a weird quirk that table cells paint as children of table rows,
+        // but their location have the row's location baked-in.
+        // Similar adjustment is done in LayoutTableCell::offsetFromContainer().
+        if (boxModelObject.isTableCell()) {
+            LayoutObject* parentRow = boxModelObject.parent();
+            ASSERT(parentRow && parentRow->isTableRow());
+            context.paintOffset -= toLayoutBox(parentRow)->locationOffset();
+        }
+    }
 }
 
 static PassRefPtr<TransformPaintPropertyNode> createPaintOffsetTranslationIfNeeded(const LayoutObject& object, PaintPropertyTreeBuilderContext& context)
diff --git a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilderTest.cpp b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilderTest.cpp
index 22eb5bd..42aac18 100644
--- a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilderTest.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilderTest.cpp
@@ -679,4 +679,44 @@ TEST_F(PaintPropertyTreeBuilderTest, TreeContextUnclipFromParentStackingContext)
     EXPECT_EQ(scrollerProperties->effect(), childProperties->localBorderBoxProperties()->effect);
 }
 
+TEST_F(PaintPropertyTreeBuilderTest, TableCellLayoutLocation)
+{
+    // This test verifies that the border box space of a table cell is being correctly computed.
+    // Table cells have weird location adjustment in our layout/paint implementation.
+    setBodyInnerHTML(
+        "<style>"
+        "  body {"
+        "    margin: 0;"
+        "  }"
+        "  table {"
+        "    border-spacing: 0;"
+        "    margin: 20px;"
+        "    padding: 40px;"
+        "    border: 10px solid black;"
+        "  }"
+        "  td {"
+        "    width: 100px;"
+        "    height: 100px;"
+        "    padding: 0;"
+        "  }"
+        "  #target {"
+        "    position: relative;"
+        "    width: 100px;"
+        "    height: 100px;"
+        "  }"
+        "</style>"
+        "<table>"
+        "  <tr><td></td><td></td></tr>"
+        "  <tr><td></td><td><div id='target'></div></td></tr>"
+        "</table>"
+    );
+
+    FrameView* frameView = document().view();
+    LayoutObject& target = *document().getElementById("target")->layoutObject();
+    ObjectPaintProperties* targetProperties = target.objectPaintProperties();
+
+    EXPECT_EQ(LayoutPoint(170, 170), targetProperties->localBorderBoxProperties()->paintOffset);
+    EXPECT_EQ(frameView->scrollTranslation(), targetProperties->localBorderBoxProperties()->transform);
+}
+
 } // namespace blink