Bug 590294, part -1: Clip <browser> shadow layers properly. r=tn

layout/generic/nsSubDocumentFrame.cpp

@@ -171,7 +171,6 @@ nsSubDocumentFrame::Init(nsIContent*     aContent,
     rv = nsHTMLContainerFrame::CreateViewForFrame(this, PR_TRUE);
     NS_ENSURE_SUCCESS(rv, rv);
   }
-  nsIView* view = GetView();
 
   // Set the primary frame now so that
   // DocumentViewerImpl::FindContainerView called by ShowViewer below
@@ -262,6 +261,9 @@ nsSubDocumentFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
   nsresult rv = DisplayBorderBackgroundOutline(aBuilder, aLists);
   NS_ENSURE_SUCCESS(rv, rv);
 
+  if (!mInnerView)
+    return NS_OK;
+
 #ifdef MOZ_IPC
   nsFrameLoader* frameLoader = FrameLoader();
   if (frameLoader) {
@@ -269,14 +271,21 @@ nsSubDocumentFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
     if (rfp) {
       // We're the subdoc for <browser remote="true"> and it has
       // painted content.  Display its shadow layer tree.
-      return aLists.Content()
-        ->AppendNewToTop(new (aBuilder) nsDisplayRemote(aBuilder, this, rfp));
+      nsDisplayList shadowTree;
+      shadowTree.AppendToTop(
+        new (aBuilder) nsDisplayRemote(aBuilder, this, rfp));
+
+      // Clip the shadow layers to subdoc bounds
+      nsPoint offset = GetOffsetToCrossDoc(aBuilder->ReferenceFrame());
+      nsRect bounds = mInnerView->GetBounds() + offset;
+
+      return aLists.Content()->AppendNewToTop(
+        new (aBuilder) nsDisplayClip(aBuilder, this, this, &shadowTree,
+                                     bounds));
     }
   }
 #endif
 
-  if (!mInnerView)
-    return NS_OK;
   nsIView* subdocView = mInnerView->GetFirstChild();
   if (!subdocView)
     return NS_OK;

layout/ipc/RenderFrameParent.cpp

@@ -200,9 +200,8 @@ RenderFrameParent::BuildLayer(nsDisplayListBuilder* aBuilder,
   }
 
   if (mContainer) {
-    mContainer->SetClipRect(shadowRoot->GetClipRect());
-    mContainer->SetVisibleRegion(shadowRoot->GetVisibleRegion());
     SetTransformFor(mContainer, aFrame, aBuilder);
+    mContainer->SetClipRect(nsnull);
   }
 
   AssertValidContainerOfShadowTree(mContainer, shadowRoot);