Fix asserts when updating shouldPaint for floating objects.

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 3328 matching lines @@
 }
 
 LayoutUnit LayoutBlockFlow::logicalRightFloatOffsetForLine(LayoutUnit logicalTop, LayoutUnit fixedOffset, LayoutUnit logicalHeight) const
 {
     if (m_floatingObjects && m_floatingObjects->hasRightObjects())
         return m_floatingObjects->logicalRightOffset(fixedOffset, logicalTop, logicalHeight);
 
     return fixedOffset;
 }
 
-void LayoutBlockFlow::setAncestorShouldPaintFloatingObject(const LayoutBox& floatBox, bool shouldPaint)
+void LayoutBlockFlow::setAncestorShouldPaintFloatingObject(const LayoutBox& floatBox)
 {
     ASSERT(floatBox.isFloating());
-    ASSERT(!floatBox.hasSelfPaintingLayer());
+    bool floatBoxIsSelfPaintingLayer = floatBox.hasLayer() && floatBox.layer()->isSelfPaintingLayer();
     for (LayoutObject* ancestor = floatBox.parent(); ancestor && ancestor->isLayoutBlockFlow(); ancestor = ancestor->parent()) {
         LayoutBlockFlow* ancestorBlock = toLayoutBlockFlow(ancestor);
         FloatingObjects* ancestorFloatingObjects = ancestorBlock->m_floatingObjects.get();
         if (!ancestorFloatingObjects)
             break;
         FloatingObjectSet::iterator it = ancestorFloatingObjects->mutableSet().find<FloatingObjectHashTranslator>(const_cast<LayoutBox*>(&floatBox));
         if (it == ancestorFloatingObjects->mutableSet().end())
             break;
 
         FloatingObject& floatingObject = **it;
-        if (shouldPaint) {
-            ASSERT(!floatingObject.shouldPaint());
+        if (!floatBoxIsSelfPaintingLayer) {
             // This repeats the logic in addOverhangingFloats() about shouldPaint flag:
             // - The nearest enclosing block in which the float doesn't overhang paints the float;
             // - Or even if the float overhangs, if the ancestor block has self-painting layer, it
             //   paints the float.
             if (ancestorBlock->hasSelfPaintingLayer() || !ancestorBlock->isOverhangingFloat(floatingObject)) {
                 floatingObject.setShouldPaint(true);
                 return;
             }
         } else if (floatingObject.shouldPaint()) {
             floatingObject.setShouldPaint(false);
@@ skipping 401 matching lines @@
             if (!rect.isEmpty())
                 rects.append(rect);
         }
     }
 
     if (inlineElementContinuation)
         inlineElementContinuation->addOutlineRects(rects, additionalOffset + (inlineElementContinuation->containingBlock()->location() - location()), includeBlockOverflows);
 }
 
 } // namespace blink