1 files changed, 231 insertions, 105 deletions

diff --git a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
index 99a0553..c028923 100644
--- a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
+++ b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
@@ -4,45 +4,66 @@
 
 #include "core/layout/PaintInvalidationState.h"
 
+#include "core/frame/FrameView.h"
+#include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
+#include "core/layout/LayoutPart.h"
 #include "core/layout/LayoutView.h"
 #include "core/layout/svg/LayoutSVGModelObject.h"
 #include "core/layout/svg/LayoutSVGRoot.h"
+#include "core/layout/svg/SVGLayoutSupport.h"
 #include "core/paint/PaintLayer.h"
 
+// We can't enable this by default because saturated operations of LayoutUnit
+// don't conform commutative law for overflowing results, preventing us from
+// making fast-path and slow-path always return the same result.
+#define ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH (0 && ENABLE(ASSERT))
+
 namespace blink {
 
-PaintInvalidationState::PaintInvalidationState(const LayoutView& layoutView, Vector<LayoutObject*>& pendingDelayedPaintInvalidations, const PaintInvalidationState* ownerPaintInvalidationState)
+static bool isAbsolutePositionUnderRelativePositionInline(const LayoutObject& object)
+{
+    if (object.styleRef().position() != AbsolutePosition)
+        return false;
+    if (LayoutObject* container = object.container())
+        return container->isAnonymousBlock() && container->styleRef().position() == RelativePosition;
+    return false;
+}
+
+static bool supportsCachedOffsets(const LayoutObject& object)
+{
+    // TODO(wangxianzhu): Move some conditions to fast path if possible.
+    return !object.hasTransformRelatedProperty()
+        && !object.hasReflection()
+        && !object.hasFilter()
+        && !object.isLayoutFlowThread()
+        && !object.isLayoutMultiColumnSpannerPlaceholder()
+        && object.styleRef().position() != FixedPosition
+        && !object.styleRef().isFlippedBlocksWritingMode()
+        // TODO(crbug.com/598094): Handle this in fast path.
+        && !isAbsolutePositionUnderRelativePositionInline(object);
+}
+
+PaintInvalidationState::PaintInvalidationState(const LayoutView& layoutView, Vector<LayoutObject*>& pendingDelayedPaintInvalidations)
     : m_currentObject(layoutView)
     , m_clipped(false)
     , m_cachedOffsetsEnabled(true)
     , m_forcedSubtreeInvalidationWithinContainer(false)
     , m_forcedSubtreeInvalidationRectUpdateWithinContainer(false)
-    , m_viewClippingAndScrollOffsetDisabled(false)
     , m_paintInvalidationContainer(layoutView.containerForPaintInvalidation())
     , m_pendingDelayedPaintInvalidations(pendingDelayedPaintInvalidations)
     , m_enclosingSelfPaintingLayer(*layoutView.layer())
 #if ENABLE(ASSERT)
-    , m_didUpdatePaintOffsetAndClipForChildren(true)
+    , m_didUpdateForChildren(false)
 #endif
 {
-    ASSERT(!ownerPaintInvalidationState || ownerPaintInvalidationState->m_didUpdatePaintOffsetAndClipForChildren);
-
-    bool establishesPaintInvalidationContainer = layoutView == m_paintInvalidationContainer;
-    if (!establishesPaintInvalidationContainer) {
-        if ((ownerPaintInvalidationState && !ownerPaintInvalidationState->m_cachedOffsetsEnabled)
-            || !layoutView.supportsPaintInvalidationStateCachedOffsets()) {
-            m_cachedOffsetsEnabled = false;
-            return;
-        }
-        if (ownerPaintInvalidationState && ownerPaintInvalidationState->m_forcedSubtreeInvalidationWithinContainer)
-            m_forcedSubtreeInvalidationWithinContainer = true;
-        FloatPoint point = layoutView.localToAncestorPoint(FloatPoint(), &m_paintInvalidationContainer, TraverseDocumentBoundaries);
-        m_paintOffset = LayoutSize(point.x(), point.y());
+    if (!supportsCachedOffsets(layoutView)) {
+        m_cachedOffsetsEnabled = false;
+        return;
     }
-    m_clipRect = layoutView.viewRect();
-    m_clipRect.move(m_paintOffset);
-    m_clipped = true;
+
+    FloatPoint point = layoutView.localToAncestorPoint(FloatPoint(), &m_paintInvalidationContainer, TraverseDocumentBoundaries | InputIsInFrameCoordinates);
+    m_paintOffset = LayoutSize(point.x(), point.y());
 }
 
 // TODO(wangxianzhu): This is temporary for positioned object whose paintInvalidationContainer is different from
@@ -53,7 +74,6 @@ PaintInvalidationState::PaintInvalidationState(const PaintInvalidationState& par
     , m_cachedOffsetsEnabled(parentState.m_cachedOffsetsEnabled)
     , m_forcedSubtreeInvalidationWithinContainer(parentState.m_forcedSubtreeInvalidationWithinContainer)
     , m_forcedSubtreeInvalidationRectUpdateWithinContainer(parentState.m_forcedSubtreeInvalidationRectUpdateWithinContainer)
-    , m_viewClippingAndScrollOffsetDisabled(false)
     , m_clipRect(parentState.m_clipRect)
     , m_paintOffset(parentState.m_paintOffset)
     , m_paintInvalidationContainer(paintInvalidationContainer)
@@ -61,10 +81,10 @@ PaintInvalidationState::PaintInvalidationState(const PaintInvalidationState& par
     , m_pendingDelayedPaintInvalidations(parentState.pendingDelayedPaintInvalidationTargets())
     , m_enclosingSelfPaintingLayer(parentState.enclosingSelfPaintingLayer(currentObject))
 #if ENABLE(ASSERT)
-    , m_didUpdatePaintOffsetAndClipForChildren(true)
+    , m_didUpdateForChildren(true)
 #endif
 {
-    ASSERT(parentState.m_didUpdatePaintOffsetAndClipForChildren);
+    ASSERT(parentState.m_didUpdateForChildren);
     ASSERT(!m_cachedOffsetsEnabled);
 }
 
@@ -74,7 +94,6 @@ PaintInvalidationState::PaintInvalidationState(const PaintInvalidationState& par
     , m_cachedOffsetsEnabled(parentState.m_cachedOffsetsEnabled)
     , m_forcedSubtreeInvalidationWithinContainer(parentState.m_forcedSubtreeInvalidationWithinContainer)
     , m_forcedSubtreeInvalidationRectUpdateWithinContainer(parentState.m_forcedSubtreeInvalidationRectUpdateWithinContainer)
-    , m_viewClippingAndScrollOffsetDisabled(false)
     , m_clipRect(parentState.m_clipRect)
     , m_paintOffset(parentState.m_paintOffset)
     , m_paintInvalidationContainer(currentObject.isPaintInvalidationContainer() ? toLayoutBoxModelObject(currentObject) : parentState.m_paintInvalidationContainer)
@@ -82,35 +101,40 @@ PaintInvalidationState::PaintInvalidationState(const PaintInvalidationState& par
     , m_pendingDelayedPaintInvalidations(parentState.pendingDelayedPaintInvalidationTargets())
     , m_enclosingSelfPaintingLayer(parentState.enclosingSelfPaintingLayer(currentObject))
 #if ENABLE(ASSERT)
-    , m_didUpdatePaintOffsetAndClipForChildren(false)
+    , m_didUpdateForChildren(false)
 #endif
 {
-    ASSERT(parentState.m_didUpdatePaintOffsetAndClipForChildren);
-}
-
-void PaintInvalidationState::updatePaintOffsetAndClipForChildren()
-{
+    if (currentObject == parentState.m_currentObject) {
+        // Sometimes we create a new PaintInvalidationState from parentState on the same object
+        // (e.g. LayoutView, and the HorriblySlowRectMapping cases in LayoutBlock::invalidatePaintOfSubtreesIfNeeded()).
+        // TODO(wangxianzhu): Avoid this for RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled().
 #if ENABLE(ASSERT)
-    ASSERT(!m_didUpdatePaintOffsetAndClipForChildren);
-    m_didUpdatePaintOffsetAndClipForChildren = true;
+        m_didUpdateForChildren = parentState.m_didUpdateForChildren;
 #endif
-
-    bool establishesPaintInvalidationContainer = m_currentObject == m_paintInvalidationContainer;
-
-    if (!m_currentObject.isBoxModelObject()) {
-        // TODO(wangxianzhu): SVG could probably benefit from a stack-based optimization like html does. crbug.com/391054.
-        ASSERT(m_currentObject.isSVG());
-        ASSERT(!establishesPaintInvalidationContainer);
-        if (m_cachedOffsetsEnabled)
-            m_svgTransform = AffineTransform(m_svgTransform * m_currentObject.localToSVGParentTransform());
         return;
     }
 
-    bool fixed = m_currentObject.style()->position() == FixedPosition;
+    ASSERT(parentState.m_didUpdateForChildren);
+
+    if (!currentObject.isBoxModelObject() && !currentObject.isSVG())
+        return;
 
-    if (!m_currentObject.supportsPaintInvalidationStateCachedOffsets())
+    if (m_cachedOffsetsEnabled && !supportsCachedOffsets(currentObject))
         m_cachedOffsetsEnabled = false;
-    if (establishesPaintInvalidationContainer) {
+
+    if (currentObject.isSVG()) {
+        if (currentObject.isSVGRoot()) {
+            m_svgTransform = toLayoutSVGRoot(currentObject).localToBorderBoxTransform();
+            // Don't early return here, because the SVGRoot object needs to execute the later code
+            // as a normal LayoutBox.
+        } else {
+            ASSERT(currentObject != m_paintInvalidationContainer);
+            m_svgTransform *= currentObject.localToSVGParentTransform();
+            return;
+        }
+    }
+
+    if (currentObject == m_paintInvalidationContainer) {
         // When we hit a new paint invalidation container, we don't need to
         // continue forcing a check for paint invalidation, since we're
         // descending into a different invalidation container. (For instance if
@@ -118,102 +142,204 @@ void PaintInvalidationState::updatePaintOffsetAndClipForChildren()
         m_forcedSubtreeInvalidationWithinContainer = false;
         m_forcedSubtreeInvalidationRectUpdateWithinContainer = false;
 
-        m_clipped = false; // Will be updated in applyClipIfNeeded().
+        m_clipped = false; // Will be updated in updateForChildren().
         m_paintOffset = LayoutSize();
-    } else {
-        if (m_cachedOffsetsEnabled) {
-            if (fixed) {
-                FloatPoint fixedOffset = m_currentObject.localToAncestorPoint(FloatPoint(), &m_paintInvalidationContainer, TraverseDocumentBoundaries);
-                m_paintOffset = LayoutSize(fixedOffset.x(), fixedOffset.y());
-            } else if (m_currentObject.isBox() && !m_currentObject.isTableRow()) {
-                // We don't add locationOffset of table row because the child cells' location offsets include the row's location offset.
-                m_paintOffset += toLayoutBox(m_currentObject).locationOffset();
-            }
-
-            if (m_currentObject.isOutOfFlowPositioned() && !fixed) {
-                if (LayoutObject* container = m_currentObject.container()) {
-                    if (container->isInFlowPositioned() && container->isLayoutInline())
-                        m_paintOffset += toLayoutInline(container)->offsetForInFlowPositionedInline(toLayoutBox(m_currentObject));
-                }
-            }
+        return;
+    }
 
-            if (m_currentObject.isInFlowPositioned() && m_currentObject.hasLayer())
-                m_paintOffset += toLayoutBoxModelObject(m_currentObject).layer()->offsetForInFlowPosition();
-        }
+    if (!m_cachedOffsetsEnabled)
+        return;
 
-        m_clipped = !fixed && m_clipped;
+    if (currentObject.isLayoutView()) {
+        ASSERT(&parentState.m_currentObject == toLayoutView(currentObject).frame()->ownerLayoutObject());
+        m_paintOffset += toLayoutBox(parentState.m_currentObject).contentBoxOffset();
+        return;
     }
 
-    if (m_cachedOffsetsEnabled && m_currentObject.isSVGRoot()) {
+    if (currentObject.isBox())
+        m_paintOffset += toLayoutBox(currentObject).locationOffset();
+
+    if (currentObject.isInFlowPositioned() && currentObject.hasLayer())
+        m_paintOffset += toLayoutBoxModelObject(currentObject).layer()->offsetForInFlowPosition();
+}
+
+void PaintInvalidationState::updateForChildren()
+{
+#if ENABLE(ASSERT)
+    ASSERT(!m_didUpdateForChildren);
+    m_didUpdateForChildren = true;
+#endif
+
+    if (!m_cachedOffsetsEnabled)
+        return;
+
+    if (!m_currentObject.isBoxModelObject() && !m_currentObject.isSVG())
+        return;
+
+    if (m_currentObject.isLayoutView()) {
+        if (!m_currentObject.document().settings() || !m_currentObject.document().settings()->rootLayerScrolls()) {
+            if (m_currentObject != m_paintInvalidationContainer) {
+                m_paintOffset -= toLayoutView(m_currentObject).frameView()->scrollOffset();
+                addClipRectRelativeToPaintOffset(toLayoutView(m_currentObject).viewRect());
+            }
+            return;
+        }
+    } else if (m_currentObject.isSVGRoot()) {
         const LayoutSVGRoot& svgRoot = toLayoutSVGRoot(m_currentObject);
-        m_svgTransform = AffineTransform(svgRoot.localToBorderBoxTransform());
         if (svgRoot.shouldApplyViewportClip())
-            addClipRectRelativeToPaintOffset(LayoutSize(svgRoot.pixelSnappedSize()));
+            addClipRectRelativeToPaintOffset(LayoutRect(LayoutPoint(), LayoutSize(svgRoot.pixelSnappedSize())));
+    } else if (m_currentObject.isTableRow()) {
+        // Child table cell's locationOffset() includes its row's locationOffset().
+        m_paintOffset -= toLayoutBox(m_currentObject).locationOffset();
     }
 
-    applyClipIfNeeded();
+    if (!m_currentObject.hasOverflowClip())
+        return;
+
+    const LayoutBox& box = toLayoutBox(m_currentObject);
+
+    // Do not clip scroll layer contents because the compositor expects the whole layer
+    // to be always invalidated in-time.
+    if (box.usesCompositedScrolling())
+        ASSERT(!m_clipped); // The box should establish paint invalidation container, so no m_clipped inherited.
+    else
+        addClipRectRelativeToPaintOffset(LayoutRect(LayoutPoint(), LayoutSize(box.layer()->size())));
+
+    m_paintOffset -= box.scrolledContentOffset();
 
     // FIXME: <http://bugs.webkit.org/show_bug.cgi?id=13443> Apply control clip if present.
 }
 
-bool PaintInvalidationState::mapObjectRectToAncestor(const LayoutObject& object, const LayoutBoxModelObject* ancestor, LayoutRect& rect, VisibleRectFlags visibleRectFlags) const
+static FloatPoint slowLocalToAncestorPoint(const LayoutObject& object, const LayoutBoxModelObject& ancestor, const FloatPoint& point)
+{
+    if (object.isLayoutView())
+        return toLayoutView(object).localToAncestorPoint(point, &ancestor, TraverseDocumentBoundaries | InputIsInFrameCoordinates);
+    return object.localToAncestorPoint(point, &ancestor, TraverseDocumentBoundaries);
+}
+
+LayoutPoint PaintInvalidationState::computePositionFromPaintInvalidationBacking() const
 {
-    ASSERT(canMapToAncestor(ancestor));
+    ASSERT(!m_didUpdateForChildren);
 
-    if (ancestor == &object) {
-        if (object.isBox() && object.styleRef().isFlippedBlocksWritingMode())
-            toLayoutBox(object).flipForWritingMode(rect);
-        return true;
+    FloatPoint point;
+    if (m_paintInvalidationContainer != m_currentObject) {
+        if (m_cachedOffsetsEnabled) {
+            if (m_currentObject.isSVG() && !m_currentObject.isSVGRoot())
+                point = m_svgTransform.mapPoint(point);
+            point += FloatPoint(m_paintOffset);
+#if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
+            // TODO(wangxianzhu): We can't enable this ASSERT for now because of crbug.com/597745.
+            // ASSERT(point == slowLocalOriginToAncestorPoint(m_currentObject, m_paintInvalidationContainer, FloatPoint());
+#endif
+        } else {
+            point = slowLocalToAncestorPoint(m_currentObject, m_paintInvalidationContainer, FloatPoint());
+        }
     }
 
-    if (object.hasLayer()) {
-        if (const TransformationMatrix* transform = toLayoutBoxModelObject(object).layer()->transform())
-            rect = LayoutRect(transform->mapRect(pixelSnappedIntRect(rect)));
+    if (m_paintInvalidationContainer.layer()->groupedMapping())
+        PaintLayer::mapPointInPaintInvalidationContainerToBacking(m_paintInvalidationContainer, point);
 
-        if (object.isInFlowPositioned())
-            rect.move(toLayoutBoxModelObject(object).layer()->offsetForInFlowPosition());
-    }
+    return LayoutPoint(point);
+}
+
+LayoutRect PaintInvalidationState::computePaintInvalidationRectInBacking() const
+{
+    ASSERT(!m_didUpdateForChildren);
 
-    if (object.isBox())
-        rect.moveBy(toLayoutBox(object).location());
+    if (m_currentObject.isSVG() && !m_currentObject.isSVGRoot())
+        return computePaintInvalidationRectInBackingForSVG();
 
-    rect.move(m_paintOffset);
+    LayoutRect rect = m_currentObject.localOverflowRectForPaintInvalidation();
+    mapLocalRectToPaintInvalidationBacking(rect);
+    return rect;
+}
 
-    if (m_clipped) {
-        if (visibleRectFlags & EdgeInclusive)
-            return rect.inclusiveIntersect(m_clipRect);
-        rect.intersect(m_clipRect);
+LayoutRect PaintInvalidationState::computePaintInvalidationRectInBackingForSVG() const
+{
+    LayoutRect rect;
+    if (m_cachedOffsetsEnabled) {
+        FloatRect svgRect = SVGLayoutSupport::localOverflowRectForPaintInvalidation(m_currentObject);
+        rect = SVGLayoutSupport::transformPaintInvalidationRect(m_currentObject, m_svgTransform, svgRect);
+        rect.move(m_paintOffset);
+        if (m_clipped)
+            rect.intersect(m_clipRect);
+#if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
+        LayoutRect slowPathRect = SVGLayoutSupport::clippedOverflowRectForPaintInvalidation(m_currentObject, m_paintInvalidationContainer);
+        // TODO(crbug.com/597902): Slow path misses clipping of paintInvalidationContainer.
+        if (m_clipped)
+            slowPathRect.intersect(m_clipRect);
+        // TODO(crbug.com/597903): Fast path and slow path should generate equal empty rects.
+        ASSERT((rect.isEmpty() && slowPathRect.isEmpty()) || rect == slowPathRect);
+#endif
+    } else {
+        // TODO(wangxianzhu): Sometimes m_cachedOffsetsEnabled==false doesn't mean we can't use cached
+        // m_svgTransform. We can use hybrid fast-path (for SVG) and slow-path (for things above the SVGRoot).
+        rect = SVGLayoutSupport::clippedOverflowRectForPaintInvalidation(m_currentObject, m_paintInvalidationContainer);
     }
 
-    return !rect.isEmpty();
+    if (m_paintInvalidationContainer.layer()->groupedMapping())
+        PaintLayer::mapRectInPaintInvalidationContainerToBacking(m_paintInvalidationContainer, rect);
+    return rect;
 }
 
-void PaintInvalidationState::addClipRectRelativeToPaintOffset(const LayoutSize& clipSize)
+static void slowMapToVisibleRectInAncestorSpace(const LayoutObject& object, const LayoutBoxModelObject& ancestor, LayoutRect& rect)
 {
-    LayoutRect clipRect(toPoint(m_paintOffset), clipSize);
-    if (m_clipped) {
-        m_clipRect.intersect(clipRect);
+    // TODO(crbug.com/597965): LayoutBox::mapToVisibleRectInAncestorSpace() incorrectly flips a rect
+    // in its own space for writing mode. Here flip to workaround the flip.
+    if (object.isBox() && (toLayoutBox(object).isWritingModeRoot() || (ancestor == object && object.styleRef().isFlippedBlocksWritingMode())))
+        toLayoutBox(object).flipForWritingMode(rect);
+
+    if (object.isLayoutView()) {
+        toLayoutView(object).mapToVisibleRectInAncestorSpace(&ancestor, rect, InputIsInFrameCoordinates, DefaultVisibleRectFlags);
+    } else if (object.isSVGRoot()) {
+        // TODO(crbug.com/597813): This is to avoid the extra clip applied in LayoutSVGRoot::mapVisibleRectInAncestorSpace().
+        toLayoutSVGRoot(object).LayoutReplaced::mapToVisibleRectInAncestorSpace(&ancestor, rect);
     } else {
-        m_clipRect = clipRect;
-        m_clipped = true;
+        object.mapToVisibleRectInAncestorSpace(&ancestor, rect);
     }
 }
 
-void PaintInvalidationState::applyClipIfNeeded()
+void PaintInvalidationState::mapLocalRectToPaintInvalidationBacking(LayoutRect& rect) const
 {
-    if (!m_currentObject.hasOverflowClip())
-        return;
+    ASSERT(!m_didUpdateForChildren);
 
-    const LayoutBox& box = toLayoutBox(m_currentObject);
+    if (m_cachedOffsetsEnabled) {
+#if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
+        LayoutRect slowPathRect(rect);
+        slowMapToVisibleRectInAncestorSpace(m_currentObject, m_paintInvalidationContainer, slowPathRect);
+#endif
+        rect.move(m_paintOffset);
+        if (m_clipped)
+            rect.intersect(m_clipRect);
+#if ASSERT_SAME_RESULT_SLOW_AND_FAST_PATH
+        // Make sure that the fast path and the slow path generate the same rect.
+        // TODO(crbug.com/597902): Slow path misses clipping of paintInvalidationContainer.
+        if (m_clipped)
+            slowPathRect.intersect(m_clipRect);
+        // TODO(wangxianzhu): The isLayoutView() condition is for cases that a sub-frame creates a
+        // root PaintInvalidationState which doesn't inherit clip from ancestor frames.
+        // Remove the condition when we eliminate the latter case of PaintInvalidationState(const LayoutView&, ...).
+        // TODO(crbug.com/597903): Fast path and slow path should generate equal empty rects.
+        ASSERT(m_currentObject.isLayoutView() || (rect.isEmpty() && slowPathRect.isEmpty()) || rect == slowPathRect);
+#endif
+    } else {
+        slowMapToVisibleRectInAncestorSpace(m_currentObject, m_paintInvalidationContainer, rect);
+    }
 
-    // Do not clip scroll layer contents because the compositor expects the whole layer
-    // to be always invalidated in-time.
-    if (box.usesCompositedScrolling())
-        ASSERT(!m_clipped); // The box should establish paint invalidation container, so no m_clipped inherited.
-    else
-        addClipRectRelativeToPaintOffset(LayoutSize(box.layer()->size()));
+    if (m_paintInvalidationContainer.layer()->groupedMapping())
+        PaintLayer::mapRectInPaintInvalidationContainerToBacking(m_paintInvalidationContainer, rect);
+}
 
-    m_paintOffset -= box.scrolledContentOffset();
+void PaintInvalidationState::addClipRectRelativeToPaintOffset(const LayoutRect& localClipRect)
+{
+    LayoutRect clipRect = localClipRect;
+    clipRect.move(m_paintOffset);
+    if (m_clipped) {
+        m_clipRect.intersect(clipRect);
+    } else {
+        m_clipRect = clipRect;
+        m_clipped = true;
+    }
 }
 
 PaintLayer& PaintInvalidationState::enclosingSelfPaintingLayer(const LayoutObject& layoutObject) const