Fix for a regression in the new text fields.  Don't allow the repaint
        rect created by dynamic line layout changes to spill out of an overflow
        area's clip region.

        (There is no test, since we have no way of testing cases where we repaint
         too much rather than too little.)

        Reviewed by darin

        * rendering/bidi.cpp:
        (WebCore::RenderBlock::layoutInlineChildren):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@13971 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/WebCore/rendering/bidi.cpp b/WebCore/rendering/bidi.cpp
index f38536f..978a635 100644
--- a/WebCore/rendering/bidi.cpp
+++ b/WebCore/rendering/bidi.cpp
@@ -1717,6 +1717,9 @@
         repaintRect.setWidth(max((int)m_width, m_overflowWidth) - m_overflowLeft);
         if (repaintRect.height() == 0)
             repaintRect.setHeight(max(oldLineBottom, m_overflowHeight) - repaintRect.y());
+        if (hasOverflowClip())
+            // Don't allow this rect to spill out of our overflow box.
+            repaintRect.intersect(IntRect(0, 0, m_width, m_height));
     }
 
     if (!firstLineBox() && element() && element()->isContentEditable() && element()->rootEditableElement() == element())