diff --git a/DEPS b/DEPS
index 704888b..096b5715 100644
--- a/DEPS
+++ b/DEPS
@@ -56,7 +56,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling build tools
   # and whatever else without interference from each other.
-  'buildtools_revision': '7e08d331f188f4e3e1c624e7187dfac58c053c7c',
+  'buildtools_revision': '9a947138bc5851bce3e9ddb1c3420d12a8f27c25',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling SwiftShader
   # and whatever else without interference from each other.
diff --git a/android_webview/BUILD.gn b/android_webview/BUILD.gn
index b9633b90..5fc01b2 100644
--- a/android_webview/BUILD.gn
+++ b/android_webview/BUILD.gn
@@ -436,16 +436,18 @@
     "common/aw_hit_test_data.h",
     "common/aw_media_client_android.cc",
     "common/aw_media_client_android.h",
+    "common/aw_paths.cc",
+    "common/aw_paths.h",
     "common/aw_resource.h",
     "common/aw_switches.cc",
     "common/aw_switches.h",
+    "common/crash_reporter/aw_microdump_crash_reporter.cc",
+    "common/crash_reporter/aw_microdump_crash_reporter.h",
     "common/devtools_instrumentation.h",
     "common/render_view_messages.cc",
     "common/render_view_messages.h",
     "common/url_constants.cc",
     "common/url_constants.h",
-    "crash_reporter/aw_microdump_crash_reporter.cc",
-    "crash_reporter/aw_microdump_crash_reporter.h",
     "gpu/aw_content_gpu_client.cc",
     "gpu/aw_content_gpu_client.h",
     "lib/main/aw_main_delegate.cc",
diff --git a/android_webview/browser/aw_browser_main_parts.cc b/android_webview/browser/aw_browser_main_parts.cc
index 9ef01d0..753466b3 100644
--- a/android_webview/browser/aw_browser_main_parts.cc
+++ b/android_webview/browser/aw_browser_main_parts.cc
@@ -10,8 +10,11 @@
 #include "android_webview/browser/aw_result_codes.h"
 #include "android_webview/browser/deferred_gpu_command_service.h"
 #include "android_webview/browser/net/aw_network_change_notifier_factory.h"
+#include "android_webview/common/aw_descriptors.h"
+#include "android_webview/common/aw_paths.h"
 #include "android_webview/common/aw_resource.h"
 #include "android_webview/common/aw_switches.h"
+#include "android_webview/common/crash_reporter/aw_microdump_crash_reporter.h"
 #include "base/android/apk_assets.h"
 #include "base/android/build_info.h"
 #include "base/android/locale_utils.h"
@@ -20,6 +23,7 @@
 #include "base/files/file_path.h"
 #include "base/i18n/rtl.h"
 #include "base/path_service.h"
+#include "components/crash/content/browser/crash_dump_manager_android.h"
 #include "components/crash/content/browser/crash_dump_observer_android.h"
 #include "content/public/browser/android/synchronous_compositor.h"
 #include "content/public/browser/render_frame_host.h"
@@ -116,6 +120,18 @@
       base::android::AttachCurrentThread());
   DeferredGpuCommandService::SetInstance();
   breakpad::CrashDumpObserver::Create();
+
+  if (crash_reporter::IsCrashReporterEnabled()) {
+    base::FilePath crash_dir;
+    if (PathService::Get(android_webview::DIR_CRASH_DUMPS, &crash_dir)) {
+      if (!base::PathExists(crash_dir))
+        base::CreateDirectory(crash_dir);
+      breakpad::CrashDumpObserver::GetInstance()->RegisterClient(
+          base::MakeUnique<breakpad::CrashDumpManager>(
+              crash_dir, kAndroidMinidumpDescriptor));
+    }
+  }
+
   if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kSingleProcess)) {
     // Create the renderers crash manager on the UI thread.
diff --git a/android_webview/browser/aw_content_browser_client.cc b/android_webview/browser/aw_content_browser_client.cc
index 49b167bb..6fa422d7 100644
--- a/android_webview/browser/aw_content_browser_client.cc
+++ b/android_webview/browser/aw_content_browser_client.cc
@@ -23,11 +23,13 @@
 #include "android_webview/browser/tracing/aw_tracing_delegate.h"
 #include "android_webview/common/aw_descriptors.h"
 #include "android_webview/common/aw_switches.h"
+#include "android_webview/common/crash_reporter/aw_microdump_crash_reporter.h"
 #include "android_webview/common/render_view_messages.h"
 #include "android_webview/common/url_constants.h"
 #include "android_webview/grit/aw_resources.h"
 #include "base/android/locale_utils.h"
 #include "base/base_paths_android.h"
+#include "base/base_switches.h"
 #include "base/command_line.h"
 #include "base/files/scoped_file.h"
 #include "base/json/json_reader.h"
@@ -272,6 +274,10 @@
     // The only kind of a child process WebView can have is renderer.
     DCHECK_EQ(switches::kRendererProcess,
               command_line->GetSwitchValueASCII(switches::kProcessType));
+    // Pass crash reporter enabled state to renderer processes.
+    if (crash_reporter::IsCrashReporterEnabled()) {
+      command_line->AppendSwitch(::switches::kEnableCrashReporter);
+    }
   }
 }
 
diff --git a/android_webview/common/aw_descriptors.h b/android_webview/common/aw_descriptors.h
index e3933d5..cac8c75 100644
--- a/android_webview/common/aw_descriptors.h
+++ b/android_webview/common/aw_descriptors.h
@@ -12,6 +12,7 @@
   kAndroidWebViewMainPakDescriptor,
   kAndroidWebView100PercentPakDescriptor,
   kAndroidWebViewCrashSignalDescriptor,
+  kAndroidMinidumpDescriptor,
 };
 
 #endif  // ANDROID_WEBVIEW_COMMON_AW_DESCRIPTORS_H_
diff --git a/android_webview/common/aw_paths.cc b/android_webview/common/aw_paths.cc
new file mode 100644
index 0000000..2e57b00
--- /dev/null
+++ b/android_webview/common/aw_paths.cc
@@ -0,0 +1,36 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "android_webview/common/aw_paths.h"
+
+#include "base/android/path_utils.h"
+#include "base/base_paths_android.h"
+#include "base/files/file_util.h"
+#include "base/path_service.h"
+
+namespace android_webview {
+
+bool PathProvider(int key, base::FilePath* result) {
+  base::FilePath cur;
+
+  switch (key) {
+    case DIR_CRASH_DUMPS:
+      if (!base::android::GetCacheDirectory(&cur))
+        return false;
+      cur = cur.Append(FILE_PATH_LITERAL("WebView"))
+                .Append(FILE_PATH_LITERAL("Crash Reports"));
+      break;
+    default:
+      return false;
+  }
+
+  *result = cur;
+  return true;
+}
+
+void RegisterPathProvider() {
+  PathService::RegisterProvider(PathProvider, PATH_START, PATH_END);
+}
+
+}  // namespace android_webview
diff --git a/android_webview/common/aw_paths.h b/android_webview/common/aw_paths.h
new file mode 100644
index 0000000..7449e6b
--- /dev/null
+++ b/android_webview/common/aw_paths.h
@@ -0,0 +1,26 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef ANDROID_WEBVIEW_COMMON_AW_PATHS_H__
+#define ANDROID_WEBVIEW_COMMON_AW_PATHS_H__
+
+// This file declares path keys for webview. These can be used with
+// the PathService to access various special directories and files.
+
+namespace android_webview {
+
+enum {
+  PATH_START = 11000,
+
+  DIR_CRASH_DUMPS = PATH_START,  // Directory where crash dumps are written.
+
+  PATH_END
+};
+
+// Call once to register the provider for the path keys defined above.
+void RegisterPathProvider();
+
+}  // namespace android_webview
+
+#endif  // ANDROID_WEBVIEW_COMMON_AW_PATHS_H__
diff --git a/android_webview/crash_reporter/DEPS b/android_webview/common/crash_reporter/DEPS
similarity index 100%
rename from android_webview/crash_reporter/DEPS
rename to android_webview/common/crash_reporter/DEPS
diff --git a/android_webview/crash_reporter/aw_microdump_crash_reporter.cc b/android_webview/common/crash_reporter/aw_microdump_crash_reporter.cc
similarity index 78%
rename from android_webview/crash_reporter/aw_microdump_crash_reporter.cc
rename to android_webview/common/crash_reporter/aw_microdump_crash_reporter.cc
index f813842..6bccaf8 100644
--- a/android_webview/crash_reporter/aw_microdump_crash_reporter.cc
+++ b/android_webview/common/crash_reporter/aw_microdump_crash_reporter.cc
@@ -2,13 +2,17 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "android_webview/crash_reporter/aw_microdump_crash_reporter.h"
+#include "android_webview/common/crash_reporter/aw_microdump_crash_reporter.h"
 
+#include "android_webview/common/aw_descriptors.h"
+#include "android_webview/common/aw_paths.h"
 #include "android_webview/common/aw_version_info_values.h"
 #include "base/android/build_info.h"
+#include "base/base_paths_android.h"
 #include "base/debug/dump_without_crashing.h"
 #include "base/files/file_path.h"
 #include "base/lazy_instance.h"
+#include "base/path_service.h"
 #include "base/scoped_native_library.h"
 #include "base/synchronization/lock.h"
 #include "build/build_config.h"
@@ -23,7 +27,8 @@
 
 class AwCrashReporterClient : public ::crash_reporter::CrashReporterClient {
  public:
-  AwCrashReporterClient() : dump_fd_(-1), crash_signal_fd_(-1) {}
+  AwCrashReporterClient()
+      : dump_fd_(kAndroidMinidumpDescriptor), crash_signal_fd_(-1) {}
 
   // Does not use lock, can only be called immediately after creation.
   void set_crash_signal_fd(int fd) { crash_signal_fd_ = fd; }
@@ -34,7 +39,7 @@
 
   void GetProductNameAndVersion(const char** product_name,
                                 const char** version) override {
-    *product_name = "WebView";
+    *product_name = "AndroidWebView";
     *version = PRODUCT_VERSION;
   }
   // Microdumps are always enabled in WebView builds, conversely to what happens
@@ -46,18 +51,19 @@
   int GetAndroidCrashSignalFD() override { return crash_signal_fd_; }
 
   bool DumpWithoutCrashingToFd(int fd) {
-    DCHECK(dump_fd_ == -1);
-    base::AutoLock lock(dump_lock_);
-    dump_fd_ = fd;
-    base::debug::DumpWithoutCrashing();
-    dump_fd_ = -1;
+    // TODO(tobiasjs): figure out what to do with on demand minidump on the
+    // renderer process of webview.
+    breakpad::GenerateMinidumpOnDemandForAndroid(fd);
     return true;
   }
 
+  bool GetCrashDumpLocation(base::FilePath* crash_dir) override {
+    return PathService::Get(android_webview::DIR_CRASH_DUMPS, crash_dir);
+  }
+
  private:
   int dump_fd_;
   int crash_signal_fd_;
-  base::Lock dump_lock_;
   DISALLOW_COPY_AND_ASSIGN(AwCrashReporterClient);
 };
 
@@ -125,10 +131,9 @@
 
 }  // namespace
 
-void EnableMicrodumpCrashReporter(const std::string& process_type,
-                                  int crash_signal_fd) {
+void EnableCrashReporter(const std::string& process_type, int crash_signal_fd) {
   if (g_enabled) {
-    NOTREACHED() << "EnableMicrodumpCrashReporter called more than once";
+    NOTREACHED() << "EnableCrashReporter called more than once";
     return;
   }
 
@@ -145,10 +150,22 @@
   }
   ::crash_reporter::SetCrashReporterClient(client);
 
-  breakpad::InitMicrodumpCrashHandlerIfNecessary(process_type);
+  bool is_browser_process =
+      process_type.empty() ||
+      process_type == breakpad::kWebViewSingleProcessType ||
+      process_type == breakpad::kBrowserProcessType;
+  if (is_browser_process) {
+    breakpad::InitCrashReporter("");
+  } else {
+    breakpad::InitNonBrowserCrashReporterForAndroid(process_type);
+  }
   g_enabled = true;
 }
 
+bool GetCrashDumpLocation(base::FilePath* crash_dir) {
+  return g_crash_reporter_client.Get().GetCrashDumpLocation(crash_dir);
+}
+
 void AddGpuFingerprintToMicrodumpCrashHandler(
     const std::string& gpu_fingerprint) {
   breakpad::AddGpuFingerprintToMicrodumpCrashHandler(gpu_fingerprint);
@@ -158,5 +175,9 @@
   return g_crash_reporter_client.Pointer()->DumpWithoutCrashingToFd(fd);
 }
 
+bool IsCrashReporterEnabled() {
+  return breakpad::IsCrashReporterEnabled();
+}
+
 }  // namespace crash_reporter
 }  // namespace android_webview
diff --git a/android_webview/crash_reporter/aw_microdump_crash_reporter.h b/android_webview/common/crash_reporter/aw_microdump_crash_reporter.h
similarity index 76%
rename from android_webview/crash_reporter/aw_microdump_crash_reporter.h
rename to android_webview/common/crash_reporter/aw_microdump_crash_reporter.h
index 33dcc344..26007d8 100644
--- a/android_webview/crash_reporter/aw_microdump_crash_reporter.h
+++ b/android_webview/common/crash_reporter/aw_microdump_crash_reporter.h
@@ -7,14 +7,19 @@
 
 #include <string>
 
+namespace base {
+class FilePath;
+}
+
 namespace android_webview {
 namespace crash_reporter {
 
-void EnableMicrodumpCrashReporter(const std::string& process_type,
-                                  int crash_signal_fd);
+void EnableCrashReporter(const std::string& process_type, int crash_signal_fd);
+bool GetCrashDumpLocation(base::FilePath* crash_dir);
 void AddGpuFingerprintToMicrodumpCrashHandler(
     const std::string& gpu_fingerprint);
 bool DumpWithoutCrashingToFd(int fd);
+bool IsCrashReporterEnabled();
 }  // namespace crash_reporter
 }  // namespace android_webview
 
diff --git a/android_webview/java/src/org/chromium/android_webview/AwBrowserProcess.java b/android_webview/java/src/org/chromium/android_webview/AwBrowserProcess.java
index 4831fcf1..f657e5bb 100644
--- a/android_webview/java/src/org/chromium/android_webview/AwBrowserProcess.java
+++ b/android_webview/java/src/org/chromium/android_webview/AwBrowserProcess.java
@@ -163,8 +163,9 @@
             @Override
             protected Void doInBackground(Void... params) {
                 final Context appContext = ContextUtils.getApplicationContext();
-                final CrashFileManager crashFileManager =
-                        new CrashFileManager(appContext.getCacheDir());
+                final File crashSpoolDir = new File(appContext.getCacheDir().getPath(), "WebView");
+                if (!crashSpoolDir.isDirectory()) return null;
+                final CrashFileManager crashFileManager = new CrashFileManager(crashSpoolDir);
                 final File[] minidumpFiles =
                         crashFileManager.getAllMinidumpFiles(MAX_MINIDUMP_UPLOAD_TRIES);
                 if (minidumpFiles.length == 0) return null;
diff --git a/android_webview/lib/main/aw_main_delegate.cc b/android_webview/lib/main/aw_main_delegate.cc
index 4b2b973..27601c5 100644
--- a/android_webview/lib/main/aw_main_delegate.cc
+++ b/android_webview/lib/main/aw_main_delegate.cc
@@ -12,8 +12,9 @@
 #include "android_webview/browser/deferred_gpu_command_service.h"
 #include "android_webview/browser/scoped_allow_wait_for_legacy_web_view_api.h"
 #include "android_webview/common/aw_descriptors.h"
+#include "android_webview/common/aw_paths.h"
 #include "android_webview/common/aw_switches.h"
-#include "android_webview/crash_reporter/aw_microdump_crash_reporter.h"
+#include "android_webview/common/crash_reporter/aw_microdump_crash_reporter.h"
 #include "android_webview/gpu/aw_content_gpu_client.h"
 #include "android_webview/native/aw_locale_manager_impl.h"
 #include "android_webview/native/aw_media_url_interceptor.h"
@@ -152,6 +153,8 @@
 
   CommandLineHelper::AddDisabledFeature(*cl, features::kWebPayments.name);
 
+  android_webview::RegisterPathProvider();
+
   return false;
 }
 
@@ -197,7 +200,7 @@
     }
   }
 
-  crash_reporter::EnableMicrodumpCrashReporter(process_type, crash_signal_fd);
+  crash_reporter::EnableCrashReporter(process_type, crash_signal_fd);
 }
 
 int AwMainDelegate::RunProcess(
diff --git a/android_webview/native/aw_debug.cc b/android_webview/native/aw_debug.cc
index 37a43cc..b7d83b6 100644
--- a/android_webview/native/aw_debug.cc
+++ b/android_webview/native/aw_debug.cc
@@ -4,7 +4,7 @@
 
 #include "android_webview/native/aw_debug.h"
 
-#include "android_webview/crash_reporter/aw_microdump_crash_reporter.h"
+#include "android_webview/common/crash_reporter/aw_microdump_crash_reporter.h"
 #include "base/android/jni_android.h"
 #include "base/android/jni_string.h"
 #include "base/debug/dump_without_crashing.h"
diff --git a/components/crash/content/app/breakpad_linux.cc b/components/crash/content/app/breakpad_linux.cc
index e840ff7f..6e78cb8 100644
--- a/components/crash/content/app/breakpad_linux.cc
+++ b/components/crash/content/app/breakpad_linux.cc
@@ -869,17 +869,6 @@
       nullptr, CrashDoneInProcessNoUpload, nullptr, true, -1);
 }
 
-void GenerateMinidumpOnDemandForAndroid() {
-  int dump_fd = GetCrashReporterClient()->GetAndroidMinidumpDescriptor();
-  if (dump_fd >= 0) {
-    MinidumpDescriptor minidump_descriptor(dump_fd);
-    minidump_descriptor.set_size_limit(-1);
-    ExceptionHandler(minidump_descriptor, nullptr, MinidumpGenerated, nullptr,
-                     false, -1)
-        .WriteMinidump();
-  }
-}
-
 void MicrodumpInfo::SetGpuFingerprint(const std::string& gpu_fingerprint) {
   DCHECK(thread_checker_.CalledOnValidThread());
   DCHECK(!microdump_gpu_fingerprint_);
@@ -939,20 +928,9 @@
                            true,  // Install handlers.
                            -1);   // Server file descriptor. -1 for in-process.
 
-  if (process_type == kWebViewSingleProcessType ||
-      process_type == kBrowserProcessType) {
-    // TODO(tobiasjs): figure out what to do with on demand minidump on the
-    // renderer process of webview.
-    // We do not use |DumpProcess()| for handling programatically
-    // generated dumps for WebView because we only know the file
-    // descriptor to which we are dumping at the time of the call to
-    // |DumpWithoutCrashing()|. Therefore we need to construct the
-    // |MinidumpDescriptor| and |ExceptionHandler| instances as
-    // needed, instead of setting up |g_breakpad| at initialization
-    // time.
-    base::debug::SetDumpWithoutCrashingFunction(
-        &GenerateMinidumpOnDemandForAndroid);
-  } else if (!process_type.empty()) {
+  if (process_type != kWebViewSingleProcessType &&
+      process_type != kBrowserProcessType &&
+      !process_type.empty()) {
     g_signal_code_pipe_fd =
         GetCrashReporterClient()->GetAndroidCrashSignalFD();
     if (g_signal_code_pipe_fd != -1)
@@ -1958,6 +1936,16 @@
     const std::string& gpu_fingerprint) {
   g_microdump_info.Get().SetGpuFingerprint(gpu_fingerprint);
 }
+
+void GenerateMinidumpOnDemandForAndroid(int dump_fd) {
+  if (dump_fd >= 0) {
+    MinidumpDescriptor minidump_descriptor(dump_fd);
+    minidump_descriptor.set_size_limit(-1);
+    ExceptionHandler(minidump_descriptor, nullptr, MinidumpGenerated, nullptr,
+                     false, -1)
+        .WriteMinidump();
+  }
+}
 #endif  // OS_ANDROID
 
 bool IsCrashReporterEnabled() {
diff --git a/components/crash/content/app/breakpad_linux.h b/components/crash/content/app/breakpad_linux.h
index 3316fa0..a85a98c 100644
--- a/components/crash/content/app/breakpad_linux.h
+++ b/components/crash/content/app/breakpad_linux.h
@@ -38,6 +38,8 @@
 // whether InitCrashReporter() is called.
 bool IsCrashReporterEnabled();
 
+// Generates a minidump on demand for this process, writing it to |dump_fd|.
+void GenerateMinidumpOnDemandForAndroid(int dump_fd);
 }  // namespace breakpad
 
 #endif  // COMPONENTS_CRASH_CONTENT_APP_BREAKPAD_LINUX_H_
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/borders/border-inner-bleed-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/borders/border-inner-bleed-expected.png
index 1fb7a51..7fe37de 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/borders/border-inner-bleed-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/borders/border-inner-bleed-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/http/tests/misc/slow-loading-image-in-pattern-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/http/tests/misc/slow-loading-image-in-pattern-expected.txt
index bf8d58a..368ea23 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/http/tests/misc/slow-loading-image-in-pattern-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/http/tests/misc/slow-loading-image-in-pattern-expected.txt
@@ -9,7 +9,7 @@
       LayoutText {#text} at (0,20) size 535x19
         text run at (0,20) width 535: "You should see a 400x300 rect containing a tiled rendering of the Acid3 reference image."
       LayoutText {#text} at (0,0) size 0x0
-layer at (10,50) size 406x306
+layer at (10,50) size 406x306 clip at (13,53) size 400x300
   LayoutSVGRoot (positioned) {svg} at (10,50) size 406x306
     LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
       LayoutSVGResourcePattern {pattern} [id="pattern"] [patternUnits=userSpaceOnUse] [patternContentUnits=userSpaceOnUse]
diff --git a/third_party/WebKit/LayoutTests/platform/linux/svg/W3C-SVG-1.1/struct-frag-02-t-expected.png b/third_party/WebKit/LayoutTests/platform/linux/svg/W3C-SVG-1.1/struct-frag-02-t-expected.png
index 02089f6..84df11d1 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/svg/W3C-SVG-1.1/struct-frag-02-t-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/svg/W3C-SVG-1.1/struct-frag-02-t-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/svg/custom/mouse-move-on-svg-container-standalone-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/svg/custom/mouse-move-on-svg-container-standalone-expected.txt
index b1c75f0..ed163d7 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/svg/custom/mouse-move-on-svg-container-standalone-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/svg/custom/mouse-move-on-svg-container-standalone-expected.txt
@@ -1,6 +1,6 @@
 layer at (0,0) size 800x600
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 406x406
+layer at (0,0) size 406x406 clip at (3,3) size 400x400
   LayoutSVGRoot {svg} at (0,0) size 406x406
     LayoutSVGContainer {g} at (300,300) size 100x100
       LayoutSVGEllipse {circle} at (300,300) size 100x100 [fill={[type=SOLID] [color=#008000]}] [cx=350.00] [cy=350.00] [r=50.00]
diff --git a/third_party/WebKit/LayoutTests/platform/linux/svg/custom/mouse-move-on-svg-root-standalone-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/svg/custom/mouse-move-on-svg-root-standalone-expected.txt
index e374a724..fb1dc18 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/svg/custom/mouse-move-on-svg-root-standalone-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/svg/custom/mouse-move-on-svg-root-standalone-expected.txt
@@ -1,6 +1,6 @@
 layer at (0,0) size 800x600
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 406x406
+layer at (0,0) size 406x406 clip at (3,3) size 400x400
   LayoutSVGRoot {svg} at (0,0) size 406x406
     LayoutSVGEllipse {circle} at (147,147) size 100x100 [fill={[type=SOLID] [color=#008000]}] [cx=197.00] [cy=197.00] [r=50.00]
     LayoutSVGText {text} at (99.50,35) size 201x19 contains 1 chunk(s)
diff --git a/third_party/WebKit/LayoutTests/platform/linux/svg/custom/pattern-userSpaceOnUse-userToBaseTransform-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/svg/custom/pattern-userSpaceOnUse-userToBaseTransform-expected.txt
index b80ca15..a6ac8bc 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/svg/custom/pattern-userSpaceOnUse-userToBaseTransform-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/svg/custom/pattern-userSpaceOnUse-userToBaseTransform-expected.txt
@@ -32,7 +32,7 @@
       LayoutText {#text} at (408,327) size 4x19
         text run at (408,327) width 4: " "
       LayoutText {#text} at (0,0) size 0x0
-layer at (420,48) size 202x302
+layer at (420,48) size 202x302 clip at (421,49) size 200x300
   LayoutSVGRoot {svg} at (412,40) size 202x302
     LayoutSVGText {text} at (5,265) size 162x19 contains 1 chunk(s)
       LayoutSVGInlineText {#text} at (5,265) size 162x19
diff --git a/third_party/WebKit/LayoutTests/platform/linux/svg/hixie/perf/007-expected.png b/third_party/WebKit/LayoutTests/platform/linux/svg/hixie/perf/007-expected.png
index 88e03e5f..6afc7d3 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/svg/hixie/perf/007-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/svg/hixie/perf/007-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/svg/hixie/viewbox/preserveAspectRatio/001-expected.png b/third_party/WebKit/LayoutTests/platform/linux/svg/hixie/viewbox/preserveAspectRatio/001-expected.png
index 2300887e..a100a71 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/svg/hixie/viewbox/preserveAspectRatio/001-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/svg/hixie/viewbox/preserveAspectRatio/001-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-inner-bleed-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-inner-bleed-expected.png
index 616e23f..326df2e 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-inner-bleed-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-inner-bleed-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/http/tests/misc/slow-loading-image-in-pattern-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/http/tests/misc/slow-loading-image-in-pattern-expected.txt
index db390663f..0e417909 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/http/tests/misc/slow-loading-image-in-pattern-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/http/tests/misc/slow-loading-image-in-pattern-expected.txt
@@ -9,7 +9,7 @@
       LayoutText {#text} at (0,18) size 572x18
         text run at (0,18) width 572: "You should see a 400x300 rect containing a tiled rendering of the Acid3 reference image."
       LayoutText {#text} at (0,0) size 0x0
-layer at (10,50) size 406x306
+layer at (10,50) size 406x306 clip at (13,53) size 400x300
   LayoutSVGRoot (positioned) {svg} at (10,50) size 406x306
     LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
       LayoutSVGResourcePattern {pattern} [id="pattern"] [patternUnits=userSpaceOnUse] [patternContentUnits=userSpaceOnUse]
diff --git a/third_party/WebKit/LayoutTests/platform/mac/svg/W3C-SVG-1.1/struct-frag-02-t-expected.png b/third_party/WebKit/LayoutTests/platform/mac/svg/W3C-SVG-1.1/struct-frag-02-t-expected.png
index 2ce1bec..18944ae2 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/svg/W3C-SVG-1.1/struct-frag-02-t-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/svg/W3C-SVG-1.1/struct-frag-02-t-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/svg/custom/mouse-move-on-svg-container-standalone-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/svg/custom/mouse-move-on-svg-container-standalone-expected.txt
index c6c9c4aba..032d246 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/svg/custom/mouse-move-on-svg-container-standalone-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/svg/custom/mouse-move-on-svg-container-standalone-expected.txt
@@ -1,6 +1,6 @@
 layer at (0,0) size 800x600
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 406x406
+layer at (0,0) size 406x406 clip at (3,3) size 400x400
   LayoutSVGRoot {svg} at (0,0) size 406x406
     LayoutSVGContainer {g} at (300,300) size 100x100
       LayoutSVGEllipse {circle} at (300,300) size 100x100 [fill={[type=SOLID] [color=#008000]}] [cx=350.00] [cy=350.00] [r=50.00]
diff --git a/third_party/WebKit/LayoutTests/platform/mac/svg/custom/mouse-move-on-svg-root-standalone-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/svg/custom/mouse-move-on-svg-root-standalone-expected.txt
index 3f40d43..a5b616e 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/svg/custom/mouse-move-on-svg-root-standalone-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/svg/custom/mouse-move-on-svg-root-standalone-expected.txt
@@ -1,6 +1,6 @@
 layer at (0,0) size 800x600
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 406x406
+layer at (0,0) size 406x406 clip at (3,3) size 400x400
   LayoutSVGRoot {svg} at (0,0) size 406x406
     LayoutSVGEllipse {circle} at (147,147) size 100x100 [fill={[type=SOLID] [color=#008000]}] [cx=197.00] [cy=197.00] [r=50.00]
     LayoutSVGText {text} at (90.69,36) size 218.59x18 contains 1 chunk(s)
diff --git a/third_party/WebKit/LayoutTests/platform/mac/svg/custom/pattern-userSpaceOnUse-userToBaseTransform-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/svg/custom/pattern-userSpaceOnUse-userToBaseTransform-expected.txt
index ecb8422..c59c76d1 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/svg/custom/pattern-userSpaceOnUse-userToBaseTransform-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/svg/custom/pattern-userSpaceOnUse-userToBaseTransform-expected.txt
@@ -32,7 +32,7 @@
       LayoutText {#text} at (408,324) size 4x18
         text run at (408,324) width 4: " "
       LayoutText {#text} at (0,0) size 0x0
-layer at (420,44) size 202x302
+layer at (420,44) size 202x302 clip at (421,45) size 200x300
   LayoutSVGRoot {svg} at (412,36) size 202x302
     LayoutSVGText {text} at (5,266) size 172.08x18 contains 1 chunk(s)
       LayoutSVGInlineText {#text} at (5,266) size 172.08x18
diff --git a/third_party/WebKit/LayoutTests/platform/mac/svg/hixie/perf/007-expected.png b/third_party/WebKit/LayoutTests/platform/mac/svg/hixie/perf/007-expected.png
index 919ec878..f3fa3102 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/svg/hixie/perf/007-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/svg/hixie/perf/007-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/svg/hixie/viewbox/preserveAspectRatio/001-expected.png b/third_party/WebKit/LayoutTests/platform/mac/svg/hixie/viewbox/preserveAspectRatio/001-expected.png
index a2b72b4..013bd1c 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/svg/hixie/viewbox/preserveAspectRatio/001-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/svg/hixie/viewbox/preserveAspectRatio/001-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-inner-bleed-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-inner-bleed-expected.png
index 03e15b49..f749a19 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-inner-bleed-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-inner-bleed-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/http/tests/misc/slow-loading-image-in-pattern-expected.txt b/third_party/WebKit/LayoutTests/platform/win/http/tests/misc/slow-loading-image-in-pattern-expected.txt
index f63f010..a404745 100644
--- a/third_party/WebKit/LayoutTests/platform/win/http/tests/misc/slow-loading-image-in-pattern-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/http/tests/misc/slow-loading-image-in-pattern-expected.txt
@@ -9,7 +9,7 @@
       LayoutText {#text} at (0,18) size 572x17
         text run at (0,18) width 572: "You should see a 400x300 rect containing a tiled rendering of the Acid3 reference image."
       LayoutText {#text} at (0,0) size 0x0
-layer at (10,50) size 406x306
+layer at (10,50) size 406x306 clip at (13,53) size 400x300
   LayoutSVGRoot (positioned) {svg} at (10,50) size 406x306
     LayoutSVGHiddenContainer {defs} at (0,0) size 0x0
       LayoutSVGResourcePattern {pattern} [id="pattern"] [patternUnits=userSpaceOnUse] [patternContentUnits=userSpaceOnUse]
diff --git a/third_party/WebKit/LayoutTests/platform/win/svg/W3C-SVG-1.1/struct-frag-02-t-expected.png b/third_party/WebKit/LayoutTests/platform/win/svg/W3C-SVG-1.1/struct-frag-02-t-expected.png
index c34f2c7..4cf5f24 100644
--- a/third_party/WebKit/LayoutTests/platform/win/svg/W3C-SVG-1.1/struct-frag-02-t-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/svg/W3C-SVG-1.1/struct-frag-02-t-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/svg/custom/mouse-move-on-svg-container-standalone-expected.txt b/third_party/WebKit/LayoutTests/platform/win/svg/custom/mouse-move-on-svg-container-standalone-expected.txt
index 15bf461..924f4f1 100644
--- a/third_party/WebKit/LayoutTests/platform/win/svg/custom/mouse-move-on-svg-container-standalone-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/svg/custom/mouse-move-on-svg-container-standalone-expected.txt
@@ -1,6 +1,6 @@
 layer at (0,0) size 800x600
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 406x406
+layer at (0,0) size 406x406 clip at (3,3) size 400x400
   LayoutSVGRoot {svg} at (0,0) size 406x406
     LayoutSVGContainer {g} at (300,300) size 100x100
       LayoutSVGEllipse {circle} at (300,300) size 100x100 [fill={[type=SOLID] [color=#008000]}] [cx=350.00] [cy=350.00] [r=50.00]
diff --git a/third_party/WebKit/LayoutTests/platform/win/svg/custom/mouse-move-on-svg-root-standalone-expected.txt b/third_party/WebKit/LayoutTests/platform/win/svg/custom/mouse-move-on-svg-root-standalone-expected.txt
index 058b9214..ba464dd 100644
--- a/third_party/WebKit/LayoutTests/platform/win/svg/custom/mouse-move-on-svg-root-standalone-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/svg/custom/mouse-move-on-svg-root-standalone-expected.txt
@@ -1,6 +1,6 @@
 layer at (0,0) size 800x600
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 406x406
+layer at (0,0) size 406x406 clip at (3,3) size 400x400
   LayoutSVGRoot {svg} at (0,0) size 406x406
     LayoutSVGEllipse {circle} at (147,147) size 100x100 [fill={[type=SOLID] [color=#008000]}] [cx=197.00] [cy=197.00] [r=50.00]
     LayoutSVGText {text} at (90.69,36) size 218.59x17 contains 1 chunk(s)
diff --git a/third_party/WebKit/LayoutTests/platform/win/svg/custom/pattern-userSpaceOnUse-userToBaseTransform-expected.txt b/third_party/WebKit/LayoutTests/platform/win/svg/custom/pattern-userSpaceOnUse-userToBaseTransform-expected.txt
index 58752ea..143a31ca 100644
--- a/third_party/WebKit/LayoutTests/platform/win/svg/custom/pattern-userSpaceOnUse-userToBaseTransform-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/svg/custom/pattern-userSpaceOnUse-userToBaseTransform-expected.txt
@@ -32,7 +32,7 @@
       LayoutText {#text} at (408,324) size 4x17
         text run at (408,324) width 4: " "
       LayoutText {#text} at (0,0) size 0x0
-layer at (420,44) size 202x302
+layer at (420,44) size 202x302 clip at (421,45) size 200x300
   LayoutSVGRoot {svg} at (412,36) size 202x302
     LayoutSVGText {text} at (5,266) size 172.08x17 contains 1 chunk(s)
       LayoutSVGInlineText {#text} at (5,266) size 172.08x17
diff --git a/third_party/WebKit/LayoutTests/platform/win/svg/hixie/perf/007-expected.png b/third_party/WebKit/LayoutTests/platform/win/svg/hixie/perf/007-expected.png
index 27634194..7f0a94e1 100644
--- a/third_party/WebKit/LayoutTests/platform/win/svg/hixie/perf/007-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/svg/hixie/perf/007-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/svg/hixie/viewbox/preserveAspectRatio/001-expected.png b/third_party/WebKit/LayoutTests/platform/win/svg/hixie/viewbox/preserveAspectRatio/001-expected.png
index f36e699b2..ba3f838 100644
--- a/third_party/WebKit/LayoutTests/platform/win/svg/hixie/viewbox/preserveAspectRatio/001-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/svg/hixie/viewbox/preserveAspectRatio/001-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/svg/custom/viewport-update2-expected.txt b/third_party/WebKit/LayoutTests/svg/custom/viewport-update2-expected.txt
index 3eba03f..ca1112de1 100644
--- a/third_party/WebKit/LayoutTests/svg/custom/viewport-update2-expected.txt
+++ b/third_party/WebKit/LayoutTests/svg/custom/viewport-update2-expected.txt
@@ -1,6 +1,6 @@
 layer at (0,0) size 800x600
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 110x110
+layer at (0,0) size 110x110 clip at (5,5) size 100x100
   LayoutSVGRoot {svg} at (0,0) size 110x110
     LayoutSVGRect {rect} at (-100,-100) size 300x300 [fill={[type=SOLID] [color=#FF0000]}] [x=-100.00] [y=-100.00] [width=300.00] [height=300.00]
     LayoutSVGRect {rect} at (0,0) size 100x100 [fill={[type=SOLID] [color=#008000]}] [x=0.00] [y=0.00] [width=100.00] [height=100.00]
diff --git a/third_party/WebKit/LayoutTests/svg/custom/width-full-percentage-expected.png b/third_party/WebKit/LayoutTests/svg/custom/width-full-percentage-expected.png
index 8465543d..f1685105 100644
--- a/third_party/WebKit/LayoutTests/svg/custom/width-full-percentage-expected.png
+++ b/third_party/WebKit/LayoutTests/svg/custom/width-full-percentage-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/svg/filters/svg-filter-child-box-reflect.html b/third_party/WebKit/LayoutTests/svg/filters/svg-filter-child-box-reflect.html
index 42add05b..3fe5e15 100644
--- a/third_party/WebKit/LayoutTests/svg/filters/svg-filter-child-box-reflect.html
+++ b/third_party/WebKit/LayoutTests/svg/filters/svg-filter-child-box-reflect.html
@@ -11,6 +11,7 @@
   #reflect {
     -webkit-box-reflect: right;
     box-reflect: right;
+    overflow: visible;
   }
 </style>
 
diff --git a/third_party/WebKit/LayoutTests/svg/filters/svg-filter-root-box-reflect.html b/third_party/WebKit/LayoutTests/svg/filters/svg-filter-root-box-reflect.html
index d349fb98..ca24e7c 100644
--- a/third_party/WebKit/LayoutTests/svg/filters/svg-filter-root-box-reflect.html
+++ b/third_party/WebKit/LayoutTests/svg/filters/svg-filter-root-box-reflect.html
@@ -11,6 +11,7 @@
   #reflect {
     -webkit-box-reflect: right;
     box-reflect: right;
+    overflow: visible;
   }
 </style>
 
diff --git a/third_party/WebKit/Source/core/paint/BoxClipper.cpp b/third_party/WebKit/Source/core/paint/BoxClipper.cpp
index 17ca2c8..a56f689 100644
--- a/third_party/WebKit/Source/core/paint/BoxClipper.cpp
+++ b/third_party/WebKit/Source/core/paint/BoxClipper.cpp
@@ -16,13 +16,20 @@
 
 namespace blink {
 
+// Clips for boxes are applied by the box's PaintLayerClipper, if the box has
+// a self-painting PaintLayer. Otherwise the box clips itself.
+// Note that this method is very similar to
+// PaintLayerClipper::shouldClipOverflow for that reason.
+//
+// An exception is control clip, which is currently never applied by
+// PaintLayerClipper.
 static bool boxNeedsClip(const LayoutBox& box) {
   if (box.hasControlClip())
     return true;
-  if (box.isSVGRoot() && toLayoutSVGRoot(box).shouldApplyViewportClip())
-    return true;
   if (box.hasLayer() && box.layer()->isSelfPaintingLayer())
     return false;
+  if (box.isSVGRoot() && toLayoutSVGRoot(box).shouldApplyViewportClip())
+    return true;
   return box.hasOverflowClip() || box.styleRef().containsPaint();
 }
 
diff --git a/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp b/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp
index c0e23e0..7f5ee06 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayerClipper.cpp
@@ -412,9 +412,7 @@
 
   adjustClipRectsForChildren(layoutObject, clipRects);
 
-  if (shouldClipOverflow(context) || layoutObject.hasClip() ||
-      (layoutObject.isSVGRoot() &&
-       toLayoutSVGRoot(&layoutObject)->shouldApplyViewportClip())) {
+  if (shouldClipOverflow(context) || layoutObject.hasClip()) {
     // This offset cannot use convertToLayerCoords, because sometimes our
     // rootLayer may be across some transformed layer boundary, for example, in
     // the PaintLayerCompositor overlapMap, where clipRects are needed in view
@@ -546,8 +544,11 @@
 
 bool PaintLayerClipper::shouldClipOverflow(
     const ClipRectsContext& context) const {
-  return (m_layer.layoutObject()->hasOverflowClip() ||
-          m_layer.layoutObject()->styleRef().containsPaint()) &&
+  LayoutObject* layoutObject = m_layer.layoutObject();
+  return (layoutObject->hasOverflowClip() ||
+          layoutObject->styleRef().containsPaint() ||
+          (layoutObject->isSVGRoot() &&
+           toLayoutSVGRoot(layoutObject)->shouldApplyViewportClip())) &&
          shouldRespectOverflowClip(context);
 }
 
diff --git a/third_party/WebKit/Source/core/paint/PaintLayerClipperTest.cpp b/third_party/WebKit/Source/core/paint/PaintLayerClipperTest.cpp
index 951d9e3..43dfa47 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayerClipperTest.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayerClipperTest.cpp
@@ -50,12 +50,8 @@
   targetPaintLayer->clipper().calculateRects(
       context, LayoutRect(LayoutRect::infiniteIntRect()), layerBounds,
       backgroundRect, foregroundRect);
-  EXPECT_EQ(LayoutRect(LayoutRect::infiniteIntRect()), backgroundRect.rect());
-  // TODO(chrishtr): the behavior for SPv2 is actually correct, since the
-  // svg root clip should be applied to the foreground rect. See
-  // crbug.com/680325.
-  if (!RuntimeEnabledFeatures::slimmingPaintV2Enabled())
-    EXPECT_EQ(LayoutRect(LayoutRect::infiniteIntRect()), foregroundRect.rect());
+  EXPECT_EQ(LayoutRect(8, 8, 200, 300), backgroundRect.rect());
+  EXPECT_EQ(LayoutRect(8, 8, 200, 300), foregroundRect.rect());
   EXPECT_EQ(LayoutRect(8, 8, 200, 300), layerBounds);
 }
 
diff --git a/third_party/WebKit/Source/core/paint/PaintLayerPainterTest.cpp b/third_party/WebKit/Source/core/paint/PaintLayerPainterTest.cpp
index 4bdc06b..5d9d39d 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayerPainterTest.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayerPainterTest.cpp
@@ -223,11 +223,6 @@
   LayoutObject& rect = *document().getElementById("rect")->layoutObject();
   LayoutObject& div = *document().getElementById("div")->layoutObject();
 
-  DisplayItem::Type clipBoxBegin =
-      DisplayItem::paintPhaseToClipBoxType(PaintPhaseForeground);
-  DisplayItem::Type clipBoxEnd =
-      DisplayItem::clipTypeToEndClipType(clipBoxBegin);
-
   if (RuntimeEnabledFeatures::slimmingPaintV2Enabled()) {
     if (RuntimeEnabledFeatures::rootLayerScrollingEnabled()) {
       // SPv2 slips the clip box (see BoxClipper).
@@ -269,11 +264,12 @@
         TestDisplayItem(layoutView(), documentBackgroundType),
         TestDisplayItem(htmlLayer, DisplayItem::kSubsequence),
         TestDisplayItem(svgLayer, DisplayItem::kSubsequence),
-        TestDisplayItem(svg, clipBoxBegin),
+        TestDisplayItem(svg, DisplayItem::kClipLayerForeground),
         TestDisplayItem(svg, DisplayItem::kBeginTransform),
         TestDisplayItem(rect, foregroundType),
         TestDisplayItem(svg, DisplayItem::kEndTransform),
-        TestDisplayItem(svg, clipBoxEnd),
+        TestDisplayItem(svg, DisplayItem::clipTypeToEndClipType(
+                                 DisplayItem::kClipLayerForeground)),
         TestDisplayItem(svgLayer, DisplayItem::kEndSubsequence),
         TestDisplayItem(htmlLayer, DisplayItem::kEndSubsequence));
   }
@@ -337,11 +333,12 @@
         TestDisplayItem(layoutView(), documentBackgroundType),
         TestDisplayItem(htmlLayer, DisplayItem::kSubsequence),
         TestDisplayItem(svgLayer, DisplayItem::kSubsequence),
-        TestDisplayItem(svg, clipBoxBegin),
+        TestDisplayItem(svg, DisplayItem::kClipLayerForeground),
         TestDisplayItem(svg, DisplayItem::kBeginTransform),
         TestDisplayItem(rect, foregroundType),
         TestDisplayItem(svg, DisplayItem::kEndTransform),
-        TestDisplayItem(svg, clipBoxEnd),
+        TestDisplayItem(svg, DisplayItem::clipTypeToEndClipType(
+                                 DisplayItem::kClipLayerForeground)),
         TestDisplayItem(svgLayer, DisplayItem::kEndSubsequence),
         TestDisplayItem(div, backgroundType),
         TestDisplayItem(htmlLayer, DisplayItem::kEndSubsequence),
diff --git a/third_party/WebKit/Source/core/paint/ReplacedPainter.cpp b/third_party/WebKit/Source/core/paint/ReplacedPainter.cpp
index b1378a2..d4c1255d 100644
--- a/third_party/WebKit/Source/core/paint/ReplacedPainter.cpp
+++ b/third_party/WebKit/Source/core/paint/ReplacedPainter.cpp
@@ -31,12 +31,16 @@
 
   LayoutRect borderRect(adjustedPaintOffset, m_layoutReplaced.size());
 
-  if (m_layoutReplaced.style()->visibility() == EVisibility::kVisible &&
-      m_layoutReplaced.hasBoxDecorationBackground() &&
-      (paintInfo.phase == PaintPhaseForeground ||
-       paintInfo.phase == PaintPhaseSelection))
-    m_layoutReplaced.paintBoxDecorationBackground(paintInfo,
-                                                  adjustedPaintOffset);
+  if (shouldPaintSelfBlockBackground(paintInfo.phase)) {
+    if (m_layoutReplaced.style()->visibility() == EVisibility::kVisible &&
+        m_layoutReplaced.hasBoxDecorationBackground()) {
+      m_layoutReplaced.paintBoxDecorationBackground(paintInfo,
+                                                    adjustedPaintOffset);
+    }
+    // We're done. We don't bother painting any children.
+    if (paintInfo.phase == PaintPhaseSelfBlockBackgroundOnly)
+      return;
+  }
 
   if (paintInfo.phase == PaintPhaseMask) {
     m_layoutReplaced.paintMask(paintInfo, adjustedPaintOffset);
@@ -130,7 +134,8 @@
       !shouldPaintSelfOutline(paintInfo.phase) &&
       paintInfo.phase != PaintPhaseSelection &&
       paintInfo.phase != PaintPhaseMask &&
-      paintInfo.phase != PaintPhaseClippingMask)
+      paintInfo.phase != PaintPhaseClippingMask &&
+      !shouldPaintSelfBlockBackground(paintInfo.phase))
     return false;
 
   // If we're invisible or haven't received a layout yet, just bail.
diff --git a/third_party/WebKit/Source/core/paint/SVGRootPainter.cpp b/third_party/WebKit/Source/core/paint/SVGRootPainter.cpp
index 3a8ac94a..66aa8b6 100644
--- a/third_party/WebKit/Source/core/paint/SVGRootPainter.cpp
+++ b/third_party/WebKit/Source/core/paint/SVGRootPainter.cpp
@@ -43,10 +43,6 @@
   if (pixelSnappedSize(paintOffset).isEmpty())
     return;
 
-  // SVG outlines are painted during PaintPhaseForeground.
-  if (shouldPaintSelfOutline(paintInfo.phase))
-    return;
-
   // An empty viewBox also disables rendering.
   // (http://www.w3.org/TR/SVG/coords.html#ViewBoxAttribute)
   SVGSVGElement* svg = toSVGSVGElement(m_layoutSVGRoot.node());