Fix LayoutObject::paintingLayer() about multicol spanner

third_party/WebKit/Source/core/layout/LayoutObject.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 610 matching lines @@
             return toLayoutBoxModelObject(current)->layer();
     }
     // FIXME: we should get rid of detached layout subtrees, at which point this code should
     // not be reached. crbug.com/411429
     return nullptr;
 }
 
 PaintLayer* LayoutObject::paintingLayer() const
 {
     for (const LayoutObject* current = this; current; current = current->isColumnSpanAll() ? current->containingBlock() : current->parent()) {
-        if (current->hasLayer())
-            return toLayoutBoxModelObject(current)->layer()->enclosingSelfPaintingLayer();
+        if (current->hasLayer() && toLayoutBoxModelObject(current)->layer()->isSelfPaintingLayer())
+            return toLayoutBoxModelObject(current)->layer();
     }
     return nullptr;
 }
 
 bool LayoutObject::scrollRectToVisible(const LayoutRect& rect, const ScrollAlignment& alignX, const ScrollAlignment& alignY, ScrollType scrollType, bool makeVisibleInVisualViewport)
 {
     LayoutBox* enclosingBox = this->enclosingBox();
     if (!enclosingBox)
         return false;
 
@@ skipping 3058 matching lines @@
         const blink::LayoutObject* root = object1;
         while (root->parent())
             root = root->parent();
         root->showLayoutTreeAndMark(object1, "*", object2, "-", 0);
     } else {
         fprintf(stderr, "Cannot showLayoutTree. Root is (nil)\n");
     }
 }
 
 #endif