[FragmentItem] Fix NGBoxFragmentPainter::PaintTextClipMask

Bug: 982194
Change-Id: I1b55db65d9fae0903d91d0fb682da5c15ac0891c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2028876Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#737232}

third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc

@@ -412,7 +412,7 @@ void NGBoxFragmentPainter::PaintObject(
         // Self-painting inline box paints only parts of the container block.
         // Adjust |paint_offset| because it is the offset of the inline box, but
         // |descendants_| has offsets to the contaiing block.
-        DCHECK(box_item_ && box_item_->HasSelfPaintingLayer());
+        DCHECK(box_item_);
         const PhysicalOffset paint_offset_to_inline_formatting_context =
             paint_offset - box_item_->OffsetInContainerBlock();
         PaintInlineItems(paint_info.ForDescendants(),
@@ -1443,27 +1443,46 @@ void NGBoxFragmentPainter::PaintTextClipMask(GraphicsContext& context,
                                              bool object_has_multiple_boxes) {
   PaintInfo paint_info(context, mask_rect, PaintPhase::kTextClip,
                        kGlobalPaintNormalPhase, 0);
-  if (object_has_multiple_boxes) {
-    DCHECK(paint_fragment_);
-    PhysicalOffset local_offset = paint_fragment_->Offset();
-    DCHECK(paint_fragment_);
-    NGInlineBoxFragmentPainter inline_box_painter(*paint_fragment_);
-    if (box_fragment_.Style().BoxDecorationBreak() ==
-        EBoxDecorationBreak::kSlice) {
-      LayoutUnit offset_on_line;
-      LayoutUnit total_width;
-      inline_box_painter.ComputeFragmentOffsetOnLine(
-          box_fragment_.Style().Direction(), &offset_on_line, &total_width);
-      LayoutSize line_offset(offset_on_line, LayoutUnit());
-      local_offset -=
-          PhysicalOffset(box_fragment_.Style().IsHorizontalWritingMode()
-                             ? line_offset
-                             : line_offset.TransposedSize());
-    }
-    inline_box_painter.Paint(paint_info, paint_offset - local_offset);
-  } else {
+  if (!object_has_multiple_boxes) {
     PaintObject(paint_info, paint_offset);
+    return;
+  }
+
+  if (paint_fragment_) {
+    NGInlineBoxFragmentPainter inline_box_painter(*paint_fragment_);
+    PaintTextClipMask(paint_info, paint_offset - paint_fragment_->Offset(),
+                      &inline_box_painter);
+    return;
+  }
+
+  DCHECK(box_item_);
+  // TODO(kojii): Callers have the |NGInlineCursor| that can be passed down to
+  // here.
+  NGInlineCursor cursor;
+  cursor.MoveTo(*box_item_);
+  NGInlineCursor descendants = cursor.CursorForDescendants();
+  NGInlineBoxFragmentPainter inline_box_painter(*box_item_, &descendants);
+  PaintTextClipMask(paint_info,
+                    paint_offset - box_item_->OffsetInContainerBlock(),
+                    &inline_box_painter);
+}
+
+void NGBoxFragmentPainter::PaintTextClipMask(
+    const PaintInfo& paint_info,
+    PhysicalOffset paint_offset,
+    NGInlineBoxFragmentPainter* inline_box_painter) {
+  const ComputedStyle& style = box_fragment_.Style();
+  if (style.BoxDecorationBreak() == EBoxDecorationBreak::kSlice) {
+    LayoutUnit offset_on_line;
+    LayoutUnit total_width;
+    inline_box_painter->ComputeFragmentOffsetOnLine(
+        style.Direction(), &offset_on_line, &total_width);
+    if (style.IsHorizontalWritingMode())
+      paint_offset.left += offset_on_line;
+    else
+      paint_offset.top += offset_on_line;
   }
+  inline_box_painter->Paint(paint_info, paint_offset);
 }
 
 PhysicalRect NGBoxFragmentPainter::AdjustRectForScrolledContent(

third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.h

@@ -24,6 +24,7 @@ class HitTestResult;
 class NGFragmentItems;
 class NGInlineCursor;
 class NGInlineBackwardCursor;
+class NGInlineBoxFragmentPainter;
 class NGPhysicalFragment;
 class ScopedPaintState;
 struct PaintInfo;
@@ -41,6 +42,9 @@ class NGBoxFragmentPainter : public BoxPainterBase {
   // Construct for an inline formatting context.
   NGBoxFragmentPainter(const NGPaintFragment&);
   // Construct for an inline box.
+  NGBoxFragmentPainter(const NGPhysicalBoxFragment& box_fragment,
+                       const NGPaintFragment* paint_fragment,
+                       const NGFragmentItem* box_item);
   NGBoxFragmentPainter(const NGFragmentItem& item,
                        const NGPhysicalBoxFragment& fragment,
                        NGInlineCursor* descendants);
@@ -73,6 +77,9 @@ class NGBoxFragmentPainter : public BoxPainterBase {
                          const IntRect& mask_rect,
                          const PhysicalOffset& paint_offset,
                          bool object_has_multiple_boxes) override;
+  void PaintTextClipMask(const PaintInfo& paint_info,
+                         PhysicalOffset paint_offset,
+                         NGInlineBoxFragmentPainter* inline_box_painter);
   PhysicalRect AdjustRectForScrolledContent(
       const PaintInfo&,
       const BoxPainterBase::FillLayerInfo&,
@@ -82,6 +89,7 @@ class NGBoxFragmentPainter : public BoxPainterBase {
   NGBoxFragmentPainter(const NGPhysicalBoxFragment&,
                        const DisplayItemClient& display_item_client,
                        const NGPaintFragment* = nullptr,
+                       const NGFragmentItem* = nullptr,
                        NGInlineCursor* descendants = nullptr);
 
   enum MoveTo { kDontSkipChildren, kSkipChildren };
@@ -281,19 +289,24 @@ inline NGBoxFragmentPainter::NGBoxFragmentPainter(
     const NGPhysicalBoxFragment& box,
     const DisplayItemClient& display_item_client,
     const NGPaintFragment* paint_fragment,
+    const NGFragmentItem* box_item,
     NGInlineCursor* descendants)
     : BoxPainterBase(&box.GetDocument(), box.Style(), box.GeneratingNode()),
       box_fragment_(box),
       display_item_client_(display_item_client),
       paint_fragment_(paint_fragment),
       items_(box.Items()),
+      box_item_(box_item),
       descendants_(descendants) {
   DCHECK(box.IsBox() || box.IsRenderedLegend());
   DCHECK(!paint_fragment || !descendants);
 #if DCHECK_IS_ON()
   if (box.IsInlineBox()) {
+    DCHECK(paint_fragment_ || box_item_);
     if (paint_fragment)
       DCHECK_EQ(&paint_fragment->PhysicalFragment(), &box);
+    if (box_item)
+      DCHECK_EQ(box_item->BoxFragment(), &box);
   } else if (box.ChildrenInline()) {
     // If no children, there maybe or may not be NGPaintFragment.
     // TODO(kojii): To be investigated if this correct or should be fixed.
@@ -321,6 +334,7 @@ inline NGBoxFragmentPainter::NGBoxFragmentPainter(
     : NGBoxFragmentPainter(fragment,
                            *fragment.GetLayoutObject(),
                            /* paint_fragment */ nullptr,
+                           /* box_item */ nullptr,
                            /* descendants */ nullptr) {}
 
 inline NGBoxFragmentPainter::NGBoxFragmentPainter(
@@ -333,6 +347,20 @@ inline NGBoxFragmentPainter::NGBoxFragmentPainter(
               : *static_cast<const DisplayItemClient*>(
                     fragment.GetLayoutObject()),
           paint_fragment,
+          /* box_item */ nullptr,
+          /* descendants */ nullptr) {}
+
+inline NGBoxFragmentPainter::NGBoxFragmentPainter(
+    const NGPhysicalBoxFragment& fragment,
+    const NGPaintFragment* paint_fragment,
+    const NGFragmentItem* box_item)
+    : NGBoxFragmentPainter(
+          fragment,
+          paint_fragment
+              ? *static_cast<const DisplayItemClient*>(paint_fragment)
+              : *static_cast<const DisplayItemClient*>(box_item),
+          paint_fragment,
+          box_item,
           /* descendants */ nullptr) {}
 
 inline NGBoxFragmentPainter::NGBoxFragmentPainter(
@@ -349,10 +377,10 @@ inline NGBoxFragmentPainter::NGBoxFragmentPainter(
     : NGBoxFragmentPainter(fragment,
                            item,
                            /* paint_fragment */ nullptr,
+                           &item,
                            descendants) {
   DCHECK_EQ(item.BoxFragment(), &fragment);
   DCHECK(fragment.IsInlineBox());
-  box_item_ = &item;
 }
 
 }  // namespace blink

third_party/blink/renderer/core/paint/ng/ng_inline_box_fragment_painter.cc

@@ -122,7 +122,7 @@ void NGInlineBoxFragmentPainterBase::PaintBackgroundBorderShadow(
   // TODO(kojii): not applicable for line box
   NGBoxFragmentPainter box_painter(
       To<NGPhysicalBoxFragment>(inline_box_fragment_),
-      inline_box_paint_fragment_);
+      inline_box_paint_fragment_, inline_box_item_);
   const NGBorderEdges& border_edges = BorderEdges();
   PaintBoxDecorationBackground(box_painter, paint_info, paint_offset,
                                adjusted_frame_rect, geometry,

third_party/blink/renderer/core/paint/ng/ng_inline_box_fragment_painter.h

@@ -149,6 +149,13 @@ class NGInlineBoxFragmentPainter : public NGInlineBoxFragmentPainterBase {
     DCHECK_EQ(inline_box_fragment.BoxType(),
               NGPhysicalFragment::NGBoxType::kInlineBox);
   }
+  NGInlineBoxFragmentPainter(const NGFragmentItem& inline_box_item,
+                             NGInlineCursor* descendants = nullptr)
+      : NGInlineBoxFragmentPainter(inline_box_item,
+                                   *inline_box_item.BoxFragment(),
+                                   descendants) {
+    DCHECK(inline_box_item.BoxFragment());
+  }
 
   void Paint(const PaintInfo&, const PhysicalOffset& paint_offset);
 

third_party/blink/web_tests/FlagExpectations/layout-ng-fragment-item

@@ -131,7 +131,6 @@ crbug.com/626703 external/wpt/webvtt/rendering/cues-with-video/processing-model/
 crbug.com/626703 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/outline_shorthand.html [ Failure ]
 crbug.com/982194 external/wpt/webxr/events_referenceSpace_reset_inline.https.html [ Timeout ]
 crbug.com/982194 fast/backgrounds/background-clip-text-multiline-linebreak.html [ Failure ]
-crbug.com/982194 fast/backgrounds/background-clip-text-multiline.html [ Crash ]
 crbug.com/982194 fast/block/positioning/absolute-in-inline-dynamic.html [ Failure ]
 crbug.com/982194 fast/block/positioning/rel-positioned-inline-changes-width.html [ Failure ]
 crbug.com/982194 fast/css/first-line-hover-001.html [ Failure Pass ]