[spv2] Account for flipped writing modes in paint offset

Flipped writing modes cause an object's offset to be flipped relative
to its parent. This patch switches from using locationOffset to
topLeftLocation which includes writing mode handling. This matches
similar logic in PaintLayer::updateLayerPosition. A comment has been
added about removing unnecessary craws back up the tree for calculating
containing blocks.

With this patch, all fast/block/positioning tests pass, modulo our lack
of multicolumn fragment painting.

BUG=614257

Review-Url: https://codereview.chromium.org/2031873005
Cr-Commit-Position: refs/heads/master@{#398110}

third_party/WebKit/LayoutTests/TestExpectations

@@ -365,6 +365,8 @@ crbug.com/600618 virtual/spv2/svg/css/max-width.html [ Pass ]
 
 crbug.com/537409 virtual/spv2/fast/clip [ Pass ]
 crbug.com/537409 virtual/spv2/fast/overflow [ Pass ]
+crbug.com/614257 virtual/spv2/fast/block/positioning [ Pass ]
+
 # PaintArtifactCompositor doesn't implement effects yet.
 crbug.com/563667 virtual/spv2/fast/overflow/007.html [ Failure ]
 # Sub-pixel differences in layout tests for SPv2
@@ -390,19 +392,8 @@ crbug.com/589265 virtual/spv2/fast/overflow/scroll-nested-positioned-layer-in-ov
 crbug.com/589265 virtual/spv2/fast/overflow/scrollbar-position-update.html [ Failure ]
 crbug.com/589265 virtual/spv2/compositing/geometry/root-layer-update.html [ Failure ]
 
-# There are still a few real non-scrollbar failures in fast/block/positioning that need to be investigated.
-crbug.com/614257 virtual/spv2/fast/block/positioning/058.html [ Pass ]
-crbug.com/614257 virtual/spv2/fast/block/positioning/absolute-in-inline-ltr-2.html [ Pass ]
-crbug.com/614257 virtual/spv2/fast/block/positioning/absolute-in-inline-ltr-3.html [ Pass ]
-crbug.com/614257 virtual/spv2/fast/block/positioning/absolute-in-inline-ltr.html [ Pass ]
-crbug.com/614257 virtual/spv2/fast/block/positioning/absolute-in-inline-rtl-2.html [ Pass ]
-crbug.com/614257 virtual/spv2/fast/block/positioning/absolute-in-inline-rtl-3.html [ Pass ]
-crbug.com/614257 virtual/spv2/fast/block/positioning/absolute-in-inline-rtl.html [ Pass ]
-crbug.com/614257 virtual/spv2/fast/block/positioning/absolute-in-inline-short-ltr.html [ Pass ]
-crbug.com/614257 virtual/spv2/fast/block/positioning/absolute-in-inline-short-rtl.html [ Pass ]
-crbug.com/614257 virtual/spv2/fast/block/positioning/hiding-inside-relpositioned-inline.html [ Pass ]
-crbug.com/614257 virtual/spv2/fast/css/abs-pos-child-inside-rel-pos-inline-001.html [ Pass ]
-crbug.com/614257 virtual/spv2/fast/css/abs-pos-child-inside-rel-pos-inline-offset-001.html [ Pass ]
+# Multicolumn still fails to fragment in spv2.
+crbug.com/616287 virtual/spv2/fast/block/positioning/offsetLeft-offsetTop-multicolumn.html [ Failure ]
 
 # Implement scrollbars in FramePainter for SPv2
 crbug.com/589279 virtual/spv2/fast/overflow/006.html [ Failure ]
@@ -411,6 +402,18 @@ crbug.com/589279 virtual/spv2/fast/overflow/hidden-viewport-y.html [ Failure ]
 crbug.com/589279 virtual/spv2/fast/overflow/overflow-x-y.html [ Failure ]
 crbug.com/589279 virtual/spv2/fast/overflow/position-fixed-transform-clipping.html [ Failure ]
 crbug.com/589279 virtual/spv2/fast/overflow/scrollRevealButton.html [ Failure ]
+crbug.com/589279 virtual/spv2/fast/block/positioning/047.html [ Failure ]
+crbug.com/589279 virtual/spv2/fast/block/positioning/051.html [ Failure ]
+crbug.com/589279 virtual/spv2/fast/block/positioning/055.html [ Failure ]
+crbug.com/589279 virtual/spv2/fast/block/positioning/auto/007.html [ Failure ]
+crbug.com/589279 virtual/spv2/fast/block/positioning/fixed-positioning-scrollbar-bug.html [ Failure ]
+crbug.com/589279 virtual/spv2/fast/block/positioning/relative-overflow-block.html [ Failure ]
+crbug.com/589279 virtual/spv2/fast/block/positioning/relative-overflow-replaced-float.html [ Failure ]
+crbug.com/589279 virtual/spv2/fast/block/positioning/relative-overflow-replaced.html [ Failure ]
+crbug.com/589279 virtual/spv2/fast/block/positioning/vertical-lr/002.html [ Failure ]
+crbug.com/589279 virtual/spv2/fast/block/positioning/vertical-rl/002.html [ Failure ]
+crbug.com/589279 virtual/spv2/fast/block/positioning/auto/vertical-lr/005.html [ Failure ]
+crbug.com/589279 virtual/spv2/fast/block/positioning/auto/vertical-rl/005.html [ Failure ]
 # Implement table walk in PaintPropertyTreeBuilder.
 crbug.com/593525 virtual/spv2/fast/overflow/002.html [ Failure ]
 crbug.com/593525 virtual/spv2/fast/overflow/overflow-rtl-vertical.html [ Failure ]

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

@@ -345,14 +345,17 @@ static void deriveBorderBoxFromContainerContext(const LayoutObject& object, Pain
         ASSERT_NOT_REACHED();
     }
     if (boxModelObject.isBox()) {
-        context.paintOffset += toLayoutBox(boxModelObject).locationOffset();
+        // TODO(pdr): Several calls in this function walk back up the tree to calculate containers
+        // (e.g., topLeftLocation, offsetForInFlowPosition*). The containing block and other
+        // containers can be stored on PaintPropertyTreeBuilderContext instead of recomputing them.
+        context.paintOffset.moveBy(toLayoutBox(boxModelObject).topLeftLocation());
         // This is a weird quirk that table cells paint as children of table rows,
         // but their location have the row's location baked-in.
         // Similar adjustment is done in LayoutTableCell::offsetFromContainer().
         if (boxModelObject.isTableCell()) {
             LayoutObject* parentRow = boxModelObject.parent();
             ASSERT(parentRow && parentRow->isTableRow());
-            context.paintOffset -= toLayoutBox(parentRow)->locationOffset();
+            context.paintOffset.moveBy(-toLayoutBox(parentRow)->topLeftLocation());
         }
     }
 }