The problem is caused by the wrong cull rect mapped from the previous root_layer "perspective" to the new root_layer "rotate".

The following unit test reproduces the geometry mapping of the cull rect during printing:

TEST_P(GeometryMapperTest, T) {
  auto perspective = CreateTransform(t0(), TransformationMatrix().ApplyPerspective(100));
  auto rotate = CreateTransform(*perspective, TransformationMatrix().Rotate3d(45, 0, 0));
  auto r = FloatRect(-8, -258, 1066, 799);
  auto r1 = r;
  GeometryMapper::SourceToDestinationRect(&t0(), rotate.get(), r1);
  LOG(ERROR) << "Map " << r << " from root to rotate: " << r1;
}

It outputs:
Map "-8,-258 1066x799" from root to rotate: "-669.62,119.359 834.675x111.57"

The second result is what happens during printing when we map the current cull rect in the local border box space of "perspective" to the local border box space of "rotate". I expect that the mapped cull rect should at least cover the whole bounds of "rotate", but the top of the mapped cull rect seems too big.

I'm confused by the result. chrishtr and pdr, can you explain it?

I think I can explain it now: when we map the cull rect into the rotated layer with perspective, the result can be a "flipped" rectangle whose back is facing forward which is not suitable to be a cull rect. I drew graphs showing the good and bad cases: https://docs.google.com/drawings/d/1TeLkR0dm3qitGTREG5De5U0Ci6jW__WrLC9if4SEKd8/edit.

I think the simplest solution is to use infinite cull rect when there is perspective.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e6061d56dacfbb96aa073405f515e8df9ddc4a1f

commit e6061d56dacfbb96aa073405f515e8df9ddc4a1f
Author: Xianzhu Wang <wangxianzhu@chromium.org>
Date: Fri Sep 21 04:34:26 2018

[PE] Use infinite cull rect under perspective

Transform with perspective mapping sometimes doesn't work for cull rect.
See the bug for details.

Bug:  887558 
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_slimming_paint_v2;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I4d2c086f957454c6cb90a8c679e7dc5b37b95c3f
Reviewed-on: https://chromium-review.googlesource.com/1236660
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#593077}
[add] https://crrev.com/e6061d56dacfbb96aa073405f515e8df9ddc4a1f/third_party/WebKit/LayoutTests/printing/3d-rotate-under-perspective-expected.png
[add] https://crrev.com/e6061d56dacfbb96aa073405f515e8df9ddc4a1f/third_party/WebKit/LayoutTests/printing/3d-rotate-under-perspective-expected.txt
[add] https://crrev.com/e6061d56dacfbb96aa073405f515e8df9ddc4a1f/third_party/WebKit/LayoutTests/printing/3d-rotate-under-perspective.html
[modify] https://crrev.com/e6061d56dacfbb96aa073405f515e8df9ddc4a1f/third_party/blink/renderer/core/paint/paint_layer.cc
[modify] https://crrev.com/e6061d56dacfbb96aa073405f515e8df9ddc4a1f/third_party/blink/renderer/core/paint/paint_layer_painter.cc