BASELINE: Update Chromium to 51.0.2704.41

Also adds in all smaller components by reversing logic for exclusion.

Change-Id: Ibf90b506e7da088ea2f65dcf23f2b0992c504422
Reviewed-by: Joerg Bornemann <joerg.bornemann@theqtcompany.com>

1 files changed, 188 insertions, 109 deletions

diff --git a/chromium/third_party/WebKit/Source/core/layout/LayoutObject.h b/chromium/third_party/WebKit/Source/core/layout/LayoutObject.h
index 6b0551810cf..fbbb1ee1b3a 100644
--- a/chromium/third_party/WebKit/Source/core/layout/LayoutObject.h
+++ b/chromium/third_party/WebKit/Source/core/layout/LayoutObject.h
@@ -31,7 +31,7 @@
 #include "core/dom/DocumentLifecycle.h"
 #include "core/dom/Element.h"
 #include "core/editing/PositionWithAffinity.h"
-#include "core/fetch/ImageResourceClient.h"
+#include "core/fetch/ImageResourceObserver.h"
 #include "core/html/HTMLElement.h"
 #include "core/inspector/InspectorTraceEvents.h"
 #include "core/layout/HitTestRequest.h"
@@ -95,9 +95,20 @@ enum MapCoordinatesMode {
     UseTransforms = 1 << 1,
     ApplyContainerFlip = 1 << 2,
     TraverseDocumentBoundaries = 1 << 3,
+
+    // Applies to LayoutView::mapLocalToAncestor() and LayoutView::mapToVisualRectInAncestorSpace()
+    // only, to indicate the input point or rect is in frame coordinates instead of frame contents
+    // coordinates. This disables view clipping and scroll offset adjustment.
+    // TODO(wangxianzhu): Remove this when root-layer-scrolls launches.
+    InputIsInFrameCoordinates = 1 << 4,
 };
 typedef unsigned MapCoordinatesFlags;
 
+enum ScheduleRelayoutBehavior {
+    ScheduleRelayout,
+    DontScheduleRelayout
+};
+
 const LayoutUnit& caretWidth();
 
 struct AnnotatedRegionValue {
@@ -150,7 +161,7 @@ const int showTreeCharacterOffset = 39;
 // storage for children. Descendant classes that do allow children have to have a LayoutObjectChildList
 // member that stores the actual children and override virtualChildren().
 //
-// LayoutObject is an ImageResourceClient, which means that it gets notified when associated images
+// LayoutObject is an ImageResourceObserver, which means that it gets notified when associated images
 // are changed. This is used for 2 main use cases:
 // - reply to 'background-image' as we need to invalidate the background in this case.
 //   (See https://drafts.csswg.org/css-backgrounds-3/#the-background-image)
@@ -204,8 +215,9 @@ const int showTreeCharacterOffset = 39;
 // preferredLogicalWidthsDirty.
 //
 // See the individual getters below for more details about what each width is.
-class CORE_EXPORT LayoutObject : public ImageResourceClient, public DisplayItemClient {
+class CORE_EXPORT LayoutObject : public ImageResourceObserver, public DisplayItemClient {
     friend class LayoutObjectChildList;
+    friend class VisualRectMappingTest;
     WTF_MAKE_NONCOPYABLE(LayoutObject);
 public:
     // Anonymous objects should pass the document as their node, and they will then automatically be
@@ -221,7 +233,7 @@ public:
     String decoratedName() const;
 
     // DisplayItemClient methods.
-    IntRect visualRect() const override;
+    LayoutRect visualRect() const override;
     String debugName() const final;
 
     LayoutObject* parent() const { return m_parent; }
@@ -318,7 +330,7 @@ public:
             layoutObject->assertLaidOut();
     }
 
-    void assertClearedPaintInvalidationState() const
+    void assertClearedPaintInvalidationFlags() const
     {
 #ifndef NDEBUG
         if (paintInvalidationStateIsDirty()) {
@@ -328,10 +340,10 @@ public:
 #endif
     }
 
-    void assertSubtreeClearedPaintInvalidationState() const
+    void assertSubtreeClearedPaintInvalidationFlags() const
     {
         for (const LayoutObject* layoutObject = this; layoutObject; layoutObject = layoutObject->nextInPreOrder())
-            layoutObject->assertClearedPaintInvalidationState();
+            layoutObject->assertClearedPaintInvalidationFlags();
     }
 
 #endif
@@ -369,6 +381,12 @@ public:
     // Classes inserting anonymous LayoutObjects in the tree are expected to
     // check for the anonymous wrapper case with:
     //                    beforeChild->parent() != this
+    //
+    // The usage of |child/parent/sibling| in this comment actually means
+    // |child/parent/sibling| in a flat tree because a layout tree is generated
+    // from a structure of a flat tree if Shadow DOM is used.
+    // See LayoutTreeBuilderTraversal and FlatTreeTraversal.
+    //
     // See LayoutTable::addChild and LayoutBlock::addChild.
     // TODO(jchaffraix): |newChild| cannot be nullptr and should be a reference.
     virtual void addChild(LayoutObject* newChild, LayoutObject* beforeChild = nullptr);
@@ -473,7 +491,6 @@ public:
     bool isListMarker() const { return isOfType(LayoutObjectListMarker); }
     bool isMedia() const { return isOfType(LayoutObjectMedia); }
     bool isMenuList() const { return isOfType(LayoutObjectMenuList); }
-    bool isMeter() const { return isOfType(LayoutObjectMeter); }
     bool isProgress() const { return isOfType(LayoutObjectProgress); }
     bool isQuote() const { return isOfType(LayoutObjectQuote); }
     bool isLayoutButton() const { return isOfType(LayoutObjectLayoutButton); }
@@ -603,21 +620,23 @@ public:
 
     // Returns the smallest rectangle enclosing all of the painted content
     // respecting clipping, masking, filters, opacity, stroke-width and markers
-    virtual FloatRect paintInvalidationRectInLocalCoordinates() const;
+    virtual FloatRect paintInvalidationRectInLocalSVGCoordinates() const;
 
-    // This only returns the transform="" value from the element
-    // most callsites want localToParentTransform() instead.
-    virtual AffineTransform localTransform() const;
+    // This only returns the transform="" value from the SVG element.
+    // Most callsites want localToParentTransform() instead.
+    virtual AffineTransform localSVGTransform() const;
 
     // Returns the full transform mapping from local coordinates to local coords for the parent SVG layoutObject
     // This includes any viewport transforms and x/y offsets as well as the transform="" value off the element.
-    virtual const AffineTransform& localToParentTransform() const;
+    virtual const AffineTransform& localToSVGParentTransform() const;
 
     // SVG uses FloatPoint precise hit testing, and passes the point in parent
-    // coordinates instead of in paint invalidaiton container coordinates. Eventually the
+    // coordinates instead of in paint invalidation container coordinates. Eventually the
     // rest of the layout tree will move to a similar model.
     virtual bool nodeAtFloatPoint(HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
 
+    // End of SVG-specific methods.
+
     bool isAnonymous() const { return m_bitfields.isAnonymous(); }
     bool isAnonymousBlock() const
     {
@@ -625,7 +644,7 @@ public:
         // LayoutBlock::createAnonymousBlock(). This includes creating an anonymous
         // LayoutBlock having a BLOCK or BOX display. Other classes such as LayoutTextFragment
         // are not LayoutBlocks and will return false. See https://bugs.webkit.org/show_bug.cgi?id=56709.
-        return isAnonymous() && (style()->display() == BLOCK || style()->display() == BOX) && style()->styleType() == NOPSEUDO && isLayoutBlock() && !isListMarker() && !isLayoutFlowThread() && !isLayoutMultiColumnSet()
+        return isAnonymous() && (style()->display() == BLOCK || style()->display() == BOX) && style()->styleType() == PseudoIdNone && isLayoutBlock() && !isListMarker() && !isLayoutFlowThread() && !isLayoutMultiColumnSet()
             && !isLayoutFullScreen()
             && !isLayoutFullScreenPlaceholder();
     }
@@ -663,7 +682,7 @@ public:
         HasBoxDecorationBackgroundKnownToBeObscured,
         HasBoxDecorationBackgroundMayBeVisible,
     };
-    bool hasBoxDecorationBackground() const { return m_bitfields.boxDecorationBackgroundState() != NoBoxDecorationBackground; }
+    bool hasBoxDecorationBackground() const { return m_bitfields.getBoxDecorationBackgroundState() != NoBoxDecorationBackground; }
     bool boxDecorationBackgroundIsKnownToBeObscured() const;
     bool mustInvalidateFillLayersPaintOnHeightChange(const FillLayer&) const;
     bool hasBackground() const { return style()->hasBackground(); }
@@ -678,11 +697,6 @@ public:
 
     bool selfNeedsLayout() const { return m_bitfields.selfNeedsLayout(); }
     bool needsPositionedMovementLayout() const { return m_bitfields.needsPositionedMovementLayout(); }
-    bool needsPositionedMovementLayoutOnly() const
-    {
-        return m_bitfields.needsPositionedMovementLayout() && !m_bitfields.selfNeedsLayout() && !m_bitfields.normalChildNeedsLayout()
-            && !m_bitfields.posChildNeedsLayout() && !m_bitfields.needsSimplifiedNormalFlowLayout();
-    }
 
     bool posChildNeedsLayout() const { return m_bitfields.posChildNeedsLayout(); }
     bool needsSimplifiedNormalFlowLayout() const { return m_bitfields.needsSimplifiedNormalFlowLayout(); }
@@ -704,10 +718,15 @@ public:
     bool hasMask() const { return style() && style()->hasMask(); }
     bool hasClipPath() const { return style() && style()->clipPath(); }
     bool hasHiddenBackface() const { return style() && style()->backfaceVisibility() == BackfaceVisibilityHidden; }
-
-    bool hasFilter() const { return style() && style()->hasFilter(); }
     bool hasBackdropFilter() const { return style() && style()->hasBackdropFilter(); }
 
+    // Returns |true| if any property that renders using filter operations is
+    // used (including, but not limited to, 'filter').
+    bool hasFilterInducingProperty() const
+    {
+        return (style() && style()->hasFilter()) || (RuntimeEnabledFeatures::cssBoxReflectFilterEnabled() && hasReflection());
+    }
+
     bool hasShapeOutside() const { return style() && style()->shapeOutside(); }
 
     inline bool preservesNewline() const;
@@ -726,12 +745,12 @@ public:
 
     Node* node() const
     {
-        return isAnonymous() ? 0 : m_node;
+        return isAnonymous() ? nullptr : m_node;
     }
 
     Node* nonPseudoNode() const
     {
-        return isPseudoElement() ? 0 : node();
+        return isPseudoElement() ? nullptr : node();
     }
 
     void clearNode() { m_node = nullptr; }
@@ -741,11 +760,15 @@ public:
     // :first-letter pseudo elements for which their parent node is returned.
     Node* generatingNode() const { return isPseudoElement() ? node()->parentOrShadowHostNode() : node(); }
 
-    Document& document() const { return m_node->document(); }
+    Document& document() const
+    {
+        ASSERT(m_node || parent()); // crbug.com/402056
+        return m_node ? m_node->document() : parent()->document();
+    }
     LocalFrame* frame() const { return document().frame(); }
 
     virtual LayoutMultiColumnSpannerPlaceholder* spannerPlaceholder() const { return nullptr; }
-    bool isColumnSpanAll() const { return style()->columnSpan() == ColumnSpanAll && spannerPlaceholder(); }
+    bool isColumnSpanAll() const { return style()->getColumnSpan() == ColumnSpanAll && spannerPlaceholder(); }
 
     // We include isLayoutButton in this check because buttons are implemented
     // using flex box but should still support first-line|first-letter.
@@ -778,7 +801,6 @@ public:
     // If |ancestor| and |ancestorSkipped| are not null, on return *ancestorSkipped
     // is true if the layoutObject returned is an ancestor of |ancestor|.
     LayoutObject* container(const LayoutBoxModelObject* ancestor = nullptr, bool* ancestorSkipped = nullptr) const;
-    LayoutObject* containerCrossingFrameBoundaries() const;
     // Finds the container as if this object is fixed-position.
     LayoutBlock* containerForFixedPosition(const LayoutBoxModelObject* ancestor = nullptr, bool* ancestorSkipped = nullptr) const;
     // Finds the containing block as if this object is absolute-position.
@@ -904,8 +926,13 @@ public:
     // and so only should be called when the style is known not to have changed (or from setStyle).
     void setStyleInternal(PassRefPtr<ComputedStyle> style) { m_style = style; }
 
+    void setStyleWithWritingModeOfParent(PassRefPtr<ComputedStyle>);
+    void addChildWithWritingModeOfParent(LayoutObject* newChild, LayoutObject* beforeChild);
+
     void firstLineStyleDidChange(const ComputedStyle& oldStyle, const ComputedStyle& newStyle);
 
+    void clearBaseComputedStyle();
+
     // This function returns an enclosing non-anonymous LayoutBlock for this
     // element.
     // This function is not always returning the containing block as defined by
@@ -928,35 +955,69 @@ public:
     // See LayoutBlock.h for some extra explanations on containing blocks.
     LayoutBlock* containingBlock() const;
 
+    bool canContainAbsolutePositionObjects() const
+    {
+        return isPositioned() || canContainFixedPositionObjects();
+    }
+
     bool canContainFixedPositionObjects() const
     {
-        return isLayoutView() || (hasTransformRelatedProperty() && isLayoutBlock()) || isSVGForeignObject() || style()->containsPaint();
+        return isLayoutView() || ((hasTransformRelatedProperty() || style()->containsPaint()) && isLayoutBlock()) || isSVGForeignObject();
     }
 
     // Convert the given local point to absolute coordinates
     // FIXME: Temporary. If UseTransforms is true, take transforms into account. Eventually localToAbsolute() will always be transform-aware.
     FloatPoint localToAbsolute(const FloatPoint& localPoint = FloatPoint(), MapCoordinatesFlags = 0) const;
-    FloatPoint absoluteToLocal(const FloatPoint&, MapCoordinatesFlags = 0) const;
+
+    // If the LayoutBoxModelObject ancestor is non-null, the input point is in the space of the ancestor.
+    // Otherwise:
+    //   If TraverseDocumentBoundaries is specified, the input point is in the space of the local root frame.
+    //   Otherwise, the input point is in the space of the containing frame.
+    FloatPoint ancestorToLocal(LayoutBoxModelObject*, const FloatPoint&, MapCoordinatesFlags = 0) const;
+    FloatPoint absoluteToLocal(const FloatPoint& point, MapCoordinatesFlags mode = 0) const
+    {
+        return ancestorToLocal(nullptr, point, mode);
+    }
 
     // Convert a local quad to absolute coordinates, taking transforms into account.
-    FloatQuad localToAbsoluteQuad(const FloatQuad& quad, MapCoordinatesFlags mode = 0, bool* wasFixed = nullptr) const
+    FloatQuad localToAbsoluteQuad(const FloatQuad& quad, MapCoordinatesFlags mode = 0) const
     {
-        return localToAncestorQuad(quad, nullptr, mode, wasFixed);
+        return localToAncestorQuad(quad, nullptr, mode);
+    }
+
+    // Convert a quad in ancestor coordinates to local coordinates.
+    // If the LayoutBoxModelObject ancestor is non-null, the input quad is in the space of the ancestor.
+    // Otherwise:
+    //   If TraverseDocumentBoundaries is specified, the input quad is in the space of the local root frame.
+    //   Otherwise, the input quad is in the space of the containing frame.
+    FloatQuad ancestorToLocalQuad(LayoutBoxModelObject*, const FloatQuad&, MapCoordinatesFlags mode = 0) const;
+    FloatQuad absoluteToLocalQuad(const FloatQuad& quad, MapCoordinatesFlags mode = 0) const
+    {
+        return ancestorToLocalQuad(nullptr, quad, mode);
     }
-    // Convert an absolute quad to local coordinates.
-    FloatQuad absoluteToLocalQuad(const FloatQuad&, MapCoordinatesFlags mode = 0) const;
 
     // Convert a local quad into the coordinate system of container, taking transforms into account.
-    FloatQuad localToAncestorQuad(const FloatQuad&, const LayoutBoxModelObject* ancestor, MapCoordinatesFlags = 0, bool* wasFixed = nullptr) const;
-    FloatPoint localToAncestorPoint(const FloatPoint&, const LayoutBoxModelObject* ancestor, MapCoordinatesFlags = 0, bool* wasFixed = nullptr, const PaintInvalidationState* = nullptr) const;
+    // If the LayoutBoxModelObject ancestor is non-null, the result will be in the space of the ancestor.
+    // Otherwise:
+    //   If TraverseDocumentBoundaries is specified, the result will be in the space of the local root frame.
+    //   Otherwise, the result will be in the space of the containing frame.
+    FloatQuad localToAncestorQuad(const FloatQuad&, const LayoutBoxModelObject* ancestor, MapCoordinatesFlags = 0) const;
+    FloatPoint localToAncestorPoint(const FloatPoint&, const LayoutBoxModelObject* ancestor, MapCoordinatesFlags = 0) const;
     void localToAncestorRects(Vector<LayoutRect>&, const LayoutBoxModelObject* ancestor, const LayoutPoint& preOffset, const LayoutPoint& postOffset) const;
 
+    // Return the transformation matrix to map points from local to the coordinate system of a container, taking transforms into account.
+    // Passing null for |ancestor| behaves the same as localToAncestorQuad.
+    TransformationMatrix localToAncestorTransform(const LayoutBoxModelObject* ancestor, MapCoordinatesFlags = 0) const;
+    TransformationMatrix localToAbsoluteTransform(MapCoordinatesFlags mode = 0) const
+    {
+        return localToAncestorTransform(nullptr, mode);
+    }
+
     // Convert a local point into the coordinate system of backing coordinates. Also returns the backing layer if needed.
     FloatPoint localToInvalidationBackingPoint(const LayoutPoint&, PaintLayer** backingLayer = nullptr);
 
-    // Return the offset from the container() layoutObject (excluding transforms). In multi-column layout,
-    // different offsets apply at different points, so return the offset that applies to the given point.
-    virtual LayoutSize offsetFromContainer(const LayoutObject*, const LayoutPoint&, bool* offsetDependsOnPoint = nullptr) const;
+    // Return the offset from the container() layoutObject (excluding transforms and multicol).
+    virtual LayoutSize offsetFromContainer(const LayoutObject*) const;
     // Return the offset from an object up the container() chain. Asserts that none of the intermediate objects have transforms.
     LayoutSize offsetFromAncestorContainer(const LayoutObject*) const;
 
@@ -971,12 +1032,13 @@ public:
     IntRect absoluteBoundingBoxRectIgnoringTransforms() const;
 
     // Build an array of quads in absolute coords for line boxes
-    virtual void absoluteQuads(Vector<FloatQuad>&, bool* /* wasFixed */ = nullptr) const { }
+    virtual void absoluteQuads(Vector<FloatQuad>&) const { }
 
     static FloatRect absoluteBoundingBoxRectForRange(const Range*);
 
-    // the rect that will be painted if this object is passed as the paintingRoot
-    IntRect paintingRootRect(IntRect& topLevelRect);
+    // The bounding box (see: absoluteBoundingBoxRect) including all descendant
+    // bounding boxes.
+    IntRect absoluteBoundingBoxRectIncludingDescendants() const;
 
     // This function returns the minimal logical width this object can have
     // without overflowing. This means that all the opportunities for wrapping
@@ -989,7 +1051,7 @@ public:
     // However CSS 3 calls it the "min-content inline size".
     // https://drafts.csswg.org/css-sizing-3/#min-content-inline-size
     // TODO(jchaffraix): We will probably want to rename it to match CSS 3.
-    virtual LayoutUnit minPreferredLogicalWidth() const { return 0; }
+    virtual LayoutUnit minPreferredLogicalWidth() const { return LayoutUnit(); }
 
     // This function returns the maximum logical width this object can have.
     //
@@ -999,7 +1061,7 @@ public:
     // the "max-content inline size".
     // https://drafts.csswg.org/css-sizing-3/#max-content-inline-size
     // TODO(jchaffraix): We will probably want to rename it to match CSS 3.
-    virtual LayoutUnit maxPreferredLogicalWidth() const { return 0; }
+    virtual LayoutUnit maxPreferredLogicalWidth() const { return LayoutUnit(); }
 
     const ComputedStyle* style() const { return m_style.get(); }
     ComputedStyle* mutableStyle() const { return m_style.get(); }
@@ -1041,25 +1103,17 @@ public:
 
     void getTextDecorations(unsigned decorations, AppliedTextDecoration& underline, AppliedTextDecoration& overline, AppliedTextDecoration& linethrough, bool quirksMode = false, bool firstlineStyle = false);
 
-    // Return the LayoutBoxModelObject in the container chain which is responsible for painting this object, or layout view
-    // if painting is root-relative. This is the container that should be passed to the 'forPaintInvalidation'
-    // methods.
+    // Return the LayoutBoxModelObject in the container chain which
+    // is responsible for painting this object. The function crosses
+    // frames boundaries so the returned value can be in a
+    // different document.
+    //
+    // This is the container that should be passed to
+    // the '*forPaintInvalidation' methods.
     const LayoutBoxModelObject& containerForPaintInvalidation() const;
 
-    const LayoutBoxModelObject* adjustCompositedContainerForSpecialAncestors(const LayoutBoxModelObject* paintInvalidationContainer) const;
     bool isPaintInvalidationContainer() const;
 
-    LayoutRect computePaintInvalidationRect()
-    {
-        return computePaintInvalidationRect(containerForPaintInvalidation());
-    }
-
-    // Returns the paint invalidation rect for this LayoutObject in the coordinate space of the paint backing (typically a GraphicsLayer) for |paintInvalidationContainer|.
-    LayoutRect computePaintInvalidationRect(const LayoutBoxModelObject& paintInvalidationContainer, const PaintInvalidationState* = nullptr) const;
-
-    // Returns the rect bounds needed to invalidate the paint of this object, in the coordinate space of the layoutObject backing of |paintInvalidationContainer|
-    LayoutRect boundsRectForPaintInvalidation(const LayoutBoxModelObject& paintInvalidationContainer, const PaintInvalidationState* = nullptr) const;
-
     // Actually do the paint invalidate of rect r for this object which has been computed in the coordinate space
     // of the GraphicsLayer backing of |paintInvalidationContainer|. Note that this coordinaten space is not the same
     // as the local coordinate space of |paintInvalidationContainer| in the presence of layer squashing.
@@ -1070,7 +1124,7 @@ public:
     void invalidatePaintRectangleNotInvalidatingDisplayItemClients(const LayoutRect&) const;
 
     // Walk the tree after layout issuing paint invalidations for layoutObjects that have changed or moved, updating bounds that have changed, and clearing paint invalidation state.
-    virtual void invalidateTreeIfNeeded(PaintInvalidationState&);
+    virtual void invalidateTreeIfNeeded(const PaintInvalidationState&);
 
     // This function only invalidates the visual overflow.
     //
@@ -1086,13 +1140,25 @@ public:
     // Returns the rect that should have paint invalidated whenever this object changes. The rect is in the view's
     // coordinate space. This method deals with outlines and overflow.
     virtual LayoutRect absoluteClippedOverflowRect() const;
-    virtual LayoutRect clippedOverflowRectForPaintInvalidation(const LayoutBoxModelObject* paintInvalidationContainer, const PaintInvalidationState* = nullptr) const;
 
-    // Given a rect in the object's coordinate space, compute a rect suitable for invalidating paints of that
-    // rect in the coordinate space of paintInvalidationContainer.  If intermediate containers have clipping or
-    // scrolling of any kind, it is applied; but overflow clipping is *not* applied for paintInvalidationContainer
-    // itself.
-    virtual void mapToVisibleRectInAncestorSpace(const LayoutBoxModelObject* ancestor, LayoutRect&, const PaintInvalidationState*) const;
+    // Returns the rect that should have paint invalidated whenever this object changes. The rect is in the object's
+    // local coordinate space. This is for non-SVG objects and LayoutSVGRoot only. SVG objects (except LayoutSVGRoot)
+    // should use paintInvalidationRectInLocalSVGCoordinates() and map with SVG transforms instead.
+    virtual LayoutRect localOverflowRectForPaintInvalidation() const;
+
+    // Given a rect in the object's coordinate space, mutates the rect into one representing the size of its visual painted
+    // output as if |ancestor| was the root of the page: the rect is modified by any intervening clips, transforms
+    // and scrolls between |this| and |ancestor|, but not any above |ancestor|.
+    // The output is in the physical, painted coordinate pixel space of |ancestor|.
+    // Overflow clipping is *not* applied for |ancestor| itself if |ancestor| scrolls overflow.
+    // The output rect is suitable for purposes such as paint invalidation.
+    //
+    // If visualRectFlags has the EdgeInclusive bit set, clipping operations will use
+    // LayoutRect::inclusiveIntersect, and the return value of inclusiveIntersect will be propagated
+    // to the return value of this method.  Otherwise, clipping operations will use LayoutRect::intersect,
+    // and the return value will be true only if the clipped rect has non-zero area.
+    // See the documentation for LayoutRect::inclusiveIntersect for more information.
+    virtual bool mapToVisualRectInAncestorSpace(const LayoutBoxModelObject* ancestor, LayoutRect&, VisualRectFlags = DefaultVisualRectFlags) const;
 
     // Return the offset to the column in which the specified point (in flow-thread coordinates)
     // lives. This is used to convert a flow-thread point to a visual point.
@@ -1109,20 +1175,20 @@ public:
 
     // The current selection state for an object.  For blocks, the state refers to the state of the leaf
     // descendants (as described above in the SelectionState enum declaration).
-    SelectionState selectionState() const { return m_bitfields.selectionState(); }
+    SelectionState getSelectionState() const { return m_bitfields.getSelectionState(); }
     virtual void setSelectionState(SelectionState state) { m_bitfields.setSelectionState(state); }
     inline void setSelectionStateIfNeeded(SelectionState);
     bool canUpdateSelectionOnRootLineBoxes() const;
 
     // A single rectangle that encompasses all of the selected objects within this object.  Used to determine the tightest
-    // possible bounding box for the selection. The rect returned is in the coordinate space of the paint invalidation container's backing.
-    virtual LayoutRect selectionRectForPaintInvalidation(const LayoutBoxModelObject* /* paintInvalidationContainer */) const { return LayoutRect(); }
+    // possible bounding box for the selection. The rect returned is in the object's local coordinate space.
+    virtual LayoutRect localSelectionRect() const { return LayoutRect(); }
 
     // View coordinates means the coordinate space of |view()|.
     LayoutRect selectionRectInViewCoordinates() const;
 
     virtual bool canBeSelectionLeaf() const { return false; }
-    bool hasSelectedChildren() const { return selectionState() != SelectionNone; }
+    bool hasSelectedChildren() const { return getSelectionState() != SelectionNone; }
 
     bool isSelectable() const;
     // Obtains the selection colors that should be used when painting a selection.
@@ -1130,9 +1196,6 @@ public:
     Color selectionForegroundColor(const GlobalPaintFlags) const;
     Color selectionEmphasisMarkColor(const GlobalPaintFlags) const;
 
-    // Whether or not a given block needs to paint selection gaps.
-    virtual bool shouldPaintSelectionGaps() const { return false; }
-
     /**
      * Returns the local coordinates of the caret within this layout object.
      * @param caretOffset zero-based offset determining position within the layout object.
@@ -1168,14 +1231,10 @@ public:
     virtual int caretMinOffset() const;
     virtual int caretMaxOffset() const;
 
-    virtual int previousOffset(int current) const;
-    virtual int previousOffsetForBackwardDeletion(int current) const;
-    virtual int nextOffset(int current) const;
-
     // ImageResourceClient override.
     void imageChanged(ImageResource*, const IntRect* = nullptr) final;
-    bool willRenderImage(ImageResource*) final;
-    bool getImageAnimationPolicy(ImageResource*, ImageAnimationPolicy&) final;
+    bool willRenderImage() final;
+    bool getImageAnimationPolicy(ImageAnimationPolicy&) final;
 
     // Sub-classes that have an associated image need to override this function
     // to get notified of any image change.
@@ -1195,8 +1254,16 @@ public:
 
     // Map points and quads through elements, potentially via 3d transforms. You should never need to call these directly; use
     // localToAbsolute/absoluteToLocal methods instead.
-    virtual void mapLocalToAncestor(const LayoutBoxModelObject* ancestor, TransformState&, MapCoordinatesFlags = ApplyContainerFlip, bool* wasFixed = nullptr, const PaintInvalidationState* = nullptr) const;
-    virtual void mapAbsoluteToLocalPoint(MapCoordinatesFlags, TransformState&) const;
+    virtual void mapLocalToAncestor(const LayoutBoxModelObject* ancestor, TransformState&, MapCoordinatesFlags = ApplyContainerFlip) const;
+    // If the LayoutBoxModelObject ancestor is non-null, the input quad is in the space of the ancestor.
+    // Otherwise:
+    //   If TraverseDocumentBoundaries is specified, the input quad is in the space of the local root frame.
+    //   Otherwise, the input quad is in the space of the containing frame.
+    virtual void mapAncestorToLocal(const LayoutBoxModelObject*, TransformState&, MapCoordinatesFlags = ApplyContainerFlip) const;
+    void mapAbsoluteToLocalPoint(MapCoordinatesFlags flags, TransformState& transformState) const
+    {
+        return mapAncestorToLocal(nullptr, transformState, flags);
+    }
 
     // Pushes state onto LayoutGeometryMap about how to map coordinates from this layoutObject to its container, or ancestorToStopAt (whichever is encountered first).
     // Returns the layoutObject which was mapped to (container or ancestorToStopAt).
@@ -1205,7 +1272,7 @@ public:
     bool shouldUseTransformFromContainer(const LayoutObject* container) const;
     void getTransformFromContainer(const LayoutObject* container, const LayoutSize& offsetInContainer, TransformationMatrix&) const;
 
-    bool createsGroup() const { return isTransparent() || hasMask() || hasFilter() || style()->hasBlendMode(); }
+    bool createsGroup() const { return isTransparent() || hasMask() || hasFilterInducingProperty() || style()->hasBlendMode(); }
 
     // Collects rectangles that the outline of this object would be drawing along the outside of,
     // even if the object isn't styled with a outline for now. The rects also cover continuations.
@@ -1254,23 +1321,23 @@ public:
     // The previous position of the top-left corner of the object in its previous paint backing.
     const LayoutPoint& previousPositionFromPaintInvalidationBacking() const
     {
-        ASSERT(!RuntimeEnabledFeatures::slimmingPaintOffsetCachingEnabled());
+        ASSERT(!RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled());
         return m_previousPositionFromPaintInvalidationBacking;
     }
     void setPreviousPositionFromPaintInvalidationBacking(const LayoutPoint& positionFromPaintInvalidationBacking)
     {
-        ASSERT(!RuntimeEnabledFeatures::slimmingPaintOffsetCachingEnabled());
+        ASSERT(!RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled());
         m_previousPositionFromPaintInvalidationBacking = positionFromPaintInvalidationBacking;
     }
 
     bool paintOffsetChanged(const LayoutPoint& newPaintOffset) const
     {
-        ASSERT(RuntimeEnabledFeatures::slimmingPaintOffsetCachingEnabled());
+        ASSERT(RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled());
         return m_previousPositionFromPaintInvalidationBacking != uninitializedPaintOffset() && m_previousPositionFromPaintInvalidationBacking != newPaintOffset;
     }
     void setPreviousPaintOffset(const LayoutPoint& paintOffset)
     {
-        ASSERT(RuntimeEnabledFeatures::slimmingPaintOffsetCachingEnabled());
+        ASSERT(RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled());
         m_previousPositionFromPaintInvalidationBacking = paintOffset;
     }
 
@@ -1281,7 +1348,7 @@ public:
 
     bool shouldInvalidateOverflowForPaint() const { return m_bitfields.shouldInvalidateOverflowForPaint(); }
 
-    virtual void clearPaintInvalidationState(const PaintInvalidationState&);
+    virtual void clearPaintInvalidationFlags(const PaintInvalidationState&);
 
     bool mayNeedPaintInvalidation() const { return m_bitfields.mayNeedPaintInvalidation(); }
     void setMayNeedPaintInvalidation();
@@ -1304,8 +1371,6 @@ public:
         return mayNeedPaintInvalidation() || shouldDoFullPaintInvalidation() || shouldInvalidateSelection() || m_bitfields.childShouldCheckForPaintInvalidation();
     }
 
-    virtual bool supportsPaintInvalidationStateCachedOffsets() const { return !hasTransformRelatedProperty() && !hasReflection() && !style()->isFlippedBlocksWritingMode(); }
-
     virtual LayoutRect viewRect() const;
 
     void invalidateDisplayItemClient(const DisplayItemClient&) const;
@@ -1325,7 +1390,11 @@ public:
 
         LayoutObject& m_layoutObject;
     };
-    MutableForPainting mutableForPainting() const { return MutableForPainting(*this); }
+    MutableForPainting getMutableForPainting() const { return MutableForPainting(*this); }
+
+    void setIsScrollAnchorObject() { m_bitfields.setIsScrollAnchorObject(true); }
+    // Clears the IsScrollAnchorObject bit, unless any ScrollAnchor still refers to us.
+    void maybeClearIsScrollAnchorObject();
 
 protected:
     enum LayoutObjectType {
@@ -1344,7 +1413,6 @@ protected:
         LayoutObjectListMarker,
         LayoutObjectMedia,
         LayoutObjectMenuList,
-        LayoutObjectMeter,
         LayoutObjectProgress,
         LayoutObjectQuote,
         LayoutObjectLayoutButton,
@@ -1444,7 +1512,7 @@ protected:
 
     void setPreviousPaintInvalidationRect(const LayoutRect& rect) { m_previousPaintInvalidationRect = rect; }
 
-    virtual PaintInvalidationReason paintInvalidationReason(const LayoutBoxModelObject& paintInvalidationContainer,
+    virtual PaintInvalidationReason getPaintInvalidationReason(const LayoutBoxModelObject& paintInvalidationContainer,
         const LayoutRect& oldPaintInvalidationRect, const LayoutPoint& oldPositionFromPaintInvalidationBacking,
         const LayoutRect& newPaintInvalidationRect, const LayoutPoint& newPositionFromPaintInvalidationBacking) const;
 
@@ -1479,19 +1547,24 @@ protected:
     //
     // The function is overridden to handle special children
     // (e.g. percentage height descendants or reflections).
-    virtual void invalidatePaintOfSubtreesIfNeeded(PaintInvalidationState& childPaintInvalidationState);
+    virtual void invalidatePaintOfSubtreesIfNeeded(const PaintInvalidationState& childPaintInvalidationState);
 
     // This function generates the invalidation for this object only.
     // It doesn't recurse into other object, as this is handled
     // by invalidatePaintOfSubtreesIfNeeded.
-    virtual PaintInvalidationReason invalidatePaintIfNeeded(PaintInvalidationState&, const LayoutBoxModelObject& paintInvalidationContainer);
+    virtual PaintInvalidationReason invalidatePaintIfNeeded(const PaintInvalidationState&);
 
     // When this object is invalidated for paint, this method is called to invalidate any DisplayItemClients
     // owned by this object, including the object itself, LayoutText/LayoutInline line boxes, etc.,
     // not including children which will be invalidated normally during invalidateTreeIfNeeded() and
     // parts which are invalidated separately (e.g. scrollbars).
+    // The caller should ensure the enclosing layer has been setNeedsRepaint before calling this function.
     virtual void invalidateDisplayItemClients(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason) const;
 
+    // Sets enclosing layer needsRepaint, then calls invalidateDisplayItemClients().
+    // Should use this version when PaintInvalidationState is available.
+    void invalidateDisplayItemClientsWithPaintInvalidationState(const LayoutBoxModelObject& paintInvalidationContainer, const PaintInvalidationState&, PaintInvalidationReason) const;
+
     void setIsBackgroundAttachmentFixedObject(bool);
 
     void clearSelfNeedsOverflowRecalcAfterStyleChange() { m_bitfields.setSelfNeedsOverflowRecalcAfterStyleChange(false); }
@@ -1539,18 +1612,21 @@ private:
     // recomputeOverflow-capable. crbug.com/437012 and crbug.com/434700.
     inline void markContainingBlocksForOverflowRecalc();
 
-    inline void markContainerChainForPaintInvalidation();
+    inline void markAncestorsForPaintInvalidation();
 
-    inline void invalidateSelectionIfNeeded(const LayoutBoxModelObject&, PaintInvalidationReason);
+    inline void invalidateSelectionIfNeeded(const LayoutBoxModelObject& paintInvalidationContainer, const PaintInvalidationState&, PaintInvalidationReason);
 
     inline void invalidateContainerPreferredLogicalWidths();
 
+    void invalidatePaintIncludingNonSelfPaintingLayerDescendantsInternal(const LayoutBoxModelObject& paintInvalidationContainer);
+
+    // The caller should ensure the enclosing layer has been setNeedsRepaint before calling this function.
     void invalidatePaintOfPreviousPaintInvalidationRect(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason);
 
     LayoutRect previousSelectionRectForPaintInvalidation() const;
     void setPreviousSelectionRectForPaintInvalidation(const LayoutRect&);
 
-    LayoutObject* containerForAbsolutePosition(const LayoutBoxModelObject* paintInvalidationContainer = nullptr, bool* paintInvalidationContainerSkipped = nullptr) const;
+    LayoutObject* containerForAbsolutePosition(const LayoutBoxModelObject* ancestor = nullptr, bool* ancestorSkipped = nullptr) const;
 
     const LayoutBoxModelObject* enclosingCompositedContainer() const;
 
@@ -1575,13 +1651,14 @@ private:
     // The passed rect is mutated into the coordinate space of the paint invalidation container.
     const LayoutBoxModelObject* invalidatePaintRectangleInternal(const LayoutRect&) const;
 
+    LayoutObject* parentCrossingFrameBoundaries() const;
+
     static LayoutPoint uninitializedPaintOffset() { return LayoutPoint(LayoutUnit::max(), LayoutUnit::max()); }
 
     RefPtr<ComputedStyle> m_style;
 
-    // Oilpan: raw pointer back to the owning Node is considered safe.
-    GC_PLUGIN_IGNORE("http://crbug.com/509911")
-    Node* m_node;
+    // Oilpan: This untraced pointer to the owning Node is considered safe.
+    UntracedMember<Node> m_node;
 
     LayoutObject* m_parent;
     LayoutObject* m_previous;
@@ -1666,6 +1743,7 @@ private:
             , m_alwaysCreateLineBoxesForLayoutInline(false)
             , m_lastBoxDecorationBackgroundObscured(false)
             , m_isBackgroundAttachmentFixedObject(false)
+            , m_isScrollAnchorObject(false)
             , m_positionedState(IsStaticallyPositioned)
             , m_selectionState(SelectionNone)
             , m_boxDecorationBackgroundState(NoBoxDecorationBackground)
@@ -1802,6 +1880,7 @@ private:
         ADD_BOOLEAN_BITFIELD(lastBoxDecorationBackgroundObscured, LastBoxDecorationBackgroundObscured);
 
         ADD_BOOLEAN_BITFIELD(isBackgroundAttachmentFixedObject, IsBackgroundAttachmentFixedObject);
+        ADD_BOOLEAN_BITFIELD(isScrollAnchorObject, IsScrollAnchorObject);
 
     private:
         // This is the cached 'position' value of this object
@@ -1826,10 +1905,10 @@ private:
         }
         void clearPositionedState() { m_positionedState = StaticPosition; }
 
-        ALWAYS_INLINE SelectionState selectionState() const { return static_cast<SelectionState>(m_selectionState); }
+        ALWAYS_INLINE SelectionState getSelectionState() const { return static_cast<SelectionState>(m_selectionState); }
         ALWAYS_INLINE void setSelectionState(SelectionState selectionState) { m_selectionState = selectionState; }
 
-        ALWAYS_INLINE BoxDecorationBackgroundState boxDecorationBackgroundState() const { return static_cast<BoxDecorationBackgroundState>(m_boxDecorationBackgroundState); }
+        ALWAYS_INLINE BoxDecorationBackgroundState getBoxDecorationBackgroundState() const { return static_cast<BoxDecorationBackgroundState>(m_boxDecorationBackgroundState); }
         ALWAYS_INLINE void setBoxDecorationBackgroundState(BoxDecorationBackgroundState s) const { m_boxDecorationBackgroundState = s; }
 
         PaintInvalidationReason fullPaintInvalidationReason() const { return static_cast<PaintInvalidationReason>(m_fullPaintInvalidationReason); }
@@ -1861,8 +1940,8 @@ private:
     // This stores the position in the paint invalidation backing's coordinate.
     // It is used to detect layoutObject shifts that forces a full invalidation.
     // This point does *not* account for composited scrolling. See adjustInvalidationRectForCompositedScrolling().
-    // For slimmingPaintOffsetCaching, this stores the previous paint offset.
-    // TODO(wangxianzhu): Rename this to m_previousPaintOffset when we enable slimmingPaintOffsetCaching.
+    // For slimmingPaintInvalidation, this stores the previous paint offset.
+    // TODO(wangxianzhu): Rename this to m_previousPaintOffset when we enable slimmingPaintInvalidation.
     LayoutPoint m_previousPositionFromPaintInvalidationBacking;
 };
 
@@ -1900,7 +1979,7 @@ inline bool LayoutObject::documentBeingDestroyed() const
 
 inline bool LayoutObject::isBeforeContent() const
 {
-    if (style()->styleType() != BEFORE)
+    if (style()->styleType() != PseudoIdBefore)
         return false;
     // Text nodes don't have their own styles, so ignore the style on a text node.
     if (isText() && !isBR())
@@ -1910,7 +1989,7 @@ inline bool LayoutObject::isBeforeContent() const
 
 inline bool LayoutObject::isAfterContent() const
 {
-    if (style()->styleType() != AFTER)
+    if (style()->styleType() != PseudoIdAfter)
         return false;
     // Text nodes don't have their own styles, so ignore the style on a text node.
     if (isText() && !isBR())
@@ -2009,7 +2088,7 @@ inline bool LayoutObject::layerCreationAllowedForSubtree() const
 
 inline void LayoutObject::setSelectionStateIfNeeded(SelectionState state)
 {
-    if (selectionState() == state)
+    if (getSelectionState() == state)
         return;
 
     setSelectionState(state);
@@ -2035,11 +2114,11 @@ inline void LayoutObject::invalidateBackgroundObscurationStatus()
 
 inline bool LayoutObject::boxDecorationBackgroundIsKnownToBeObscured() const
 {
-    if (m_bitfields.boxDecorationBackgroundState() == HasBoxDecorationBackgroundObscurationStatusInvalid) {
+    if (m_bitfields.getBoxDecorationBackgroundState() == HasBoxDecorationBackgroundObscurationStatusInvalid) {
         BoxDecorationBackgroundState state = computeBackgroundIsKnownToBeObscured() ? HasBoxDecorationBackgroundKnownToBeObscured : HasBoxDecorationBackgroundMayBeVisible;
         m_bitfields.setBoxDecorationBackgroundState(state);
     }
-    return m_bitfields.boxDecorationBackgroundState() == HasBoxDecorationBackgroundKnownToBeObscured;
+    return m_bitfields.getBoxDecorationBackgroundState() == HasBoxDecorationBackgroundKnownToBeObscured;
 }
 
 inline void makeMatrixRenderable(TransformationMatrix& matrix, bool has3DRendering)