Use the doc rect to figure out how many pages there are

third_party/WebKit/Source/core/paint/PaintLayerPainter.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintLayerPainter.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/Settings.h"
 #include "core/layout/ClipPathOperation.h"
 #include "core/layout/LayoutBlock.h"
@@ skipping 464 matching lines @@
         if (shouldRespectOverflowClip(paintFlags, m_paintLayer.layoutObject()) == IgnoreOverflowClip)
             clipRectsContext.setIgnoreOverflowClip();
         ancestorBackgroundClipRect = m_paintLayer.clipper().backgroundClipRect(clipRectsContext);
     }
 
     LayoutObject* object = m_paintLayer.layoutObject();
     LayoutView* view = object->view();
     bool isFixedPosObjectInPagedMedia = object->style()->position() == FixedPosition && object->container() == view && view->pageLogicalHeight();
     PaintLayer* paginationLayer = m_paintLayer.enclosingPaginationLayer();
     PaintLayerFragments fragments;
-    if (isFixedPosObjectInPagedMedia) {
+    // TODO(crbug.com/619094): Figure out the correct behaviour for fixed position objects
+    // in paged media with vertical writing modes.
+    if (isFixedPosObjectInPagedMedia && view->isHorizontalWritingMode()) {
         // "For paged media, boxes with fixed positions are repeated on every page."
         // - https://www.w3.org/TR/2011/REC-CSS2-20110607/visuren.html#fixed-positioning
-        ASSERT(view->firstChild() && view->firstChild()->isLayoutBlock());
-        int pages = static_cast<int>(ceilf(toLayoutBlock(view->firstChild())->logicalHeight() / view->pageLogicalHeight()));
+        unsigned pages = ceilf(view->documentRect().height() / view->pageLogicalHeight());
         LayoutPoint paginationOffset;
-        for (int i = 0; i < pages; i++) {
+        for (unsigned i = 0; i < pages; i++) {
             PaintLayerFragment fragment;
             fragment.backgroundRect = paintingInfo.paintDirtyRect;
             fragment.paginationOffset = paginationOffset;
             fragments.append(fragment);
             paginationOffset += LayoutPoint(0, view->pageLogicalHeight());
         }
     } else if (paginationLayer) {
         // FIXME: This is a mess. Look closely at this code and the code in Layer and fix any
         // issues in it & refactor to make it obvious from code structure what it does and that it's
         // correct.
@@ skipping 301 matching lines @@
     if (!m_paintLayer.containsDirtyOverlayScrollbars())
         return;
 
     PaintLayerPaintingInfo paintingInfo(&m_paintLayer, LayoutRect(enclosingIntRect(damageRect)), paintFlags, LayoutSize());
     paintLayer(context, paintingInfo, PaintLayerPaintingOverlayScrollbars);
 
     m_paintLayer.setContainsDirtyOverlayScrollbars(false);
 }
 
 } // namespace blink