Get the correct number of pages to paint a fixed object on.

third_party/WebKit/Source/core/paint/PaintLayerPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintLayerPainter.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/Settings.h"
 #include "core/layout/ClipPathOperation.h"
 #include "core/layout/LayoutBlock.h"
@@ skipping 468 matching lines @@
 
     LayoutObject* object = m_paintLayer.layoutObject();
     LayoutView* view = object->view();
     bool isFixedPosObjectInPagedMedia = object->style()->position() == FixedPosition && object->container() == view && view->pageLogicalHeight();
     PaintLayer* paginationLayer = m_paintLayer.enclosingPaginationLayer();
     PaintLayerFragments fragments;
     if (isFixedPosObjectInPagedMedia) {
         // "For paged media, boxes with fixed positions are repeated on every page."
         // - https://www.w3.org/TR/2011/REC-CSS2-20110607/visuren.html#fixed-positioning
         ASSERT(view->firstChild() && view->firstChild()->isLayoutBlock());
-        int pages = toLayoutBlock(view->firstChild())->logicalHeight() / view->pageLogicalHeight();
+        int pages = static_cast<int>(ceilf(toLayoutBlock(view->firstChild())->logicalHeight() / view->pageLogicalHeight()));
         LayoutPoint paginationOffset;
-        for (int i = 0; i <= pages; i++) {
+        for (int i = 0; i < pages; i++) {
             PaintLayerFragment fragment;
             fragment.backgroundRect = paintingInfo.paintDirtyRect;
             fragment.paginationOffset = paginationOffset;
             fragments.append(fragment);
             paginationOffset += LayoutPoint(0, view->pageLogicalHeight());
         }
     } else if (paginationLayer) {
         // FIXME: This is a mess. Look closely at this code and the code in Layer and fix any
         // issues in it & refactor to make it obvious from code structure what it does and that it's
         // correct.
@@ skipping 301 matching lines @@
     if (!m_paintLayer.containsDirtyOverlayScrollbars())
         return;
 
     PaintLayerPaintingInfo paintingInfo(&m_paintLayer, LayoutRect(enclosingIntRect(damageRect)), paintFlags, LayoutSize());
     paintLayer(context, paintingInfo, PaintLayerPaintingOverlayScrollbars);
 
     m_paintLayer.setContainsDirtyOverlayScrollbars(false);
 }
 
 } // namespace blink