Fix assertions related to floats and z-order lists when compositing opaque scrollers

third_party/WebKit/Source/core/paint/PaintLayer.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
  *   Randall Jesup <rjesup@wgate.com>
@@ skipping 2348 matching lines @@
         return 0;
     case PaintsIntoGroupedBacking:
         return groupedMapping()->squashingLayer();
     default:
         return compositedLayerMapping()->scrollingContentsLayer() ? compositedLayerMapping()->scrollingContentsLayer() : compositedLayerMapping()->mainGraphicsLayer();
     }
 }
 
 bool PaintLayer::canPaintBackgroundOntoScrollingContentsLayer() const
 {
-    return !isRootLayer()
-        && scrollsOverflow()
-        && layoutObject()->hasLocalEquivalentBackground()
-        && !stackingNode()->hasNegativeZOrderList();
+    if (isRootLayer() || !scrollsOverflow() || !layoutObject()->hasLocalEquivalentBackground())
+        return false;
+
+    m_stackingNode->updateLayerListsIfNeeded();
+    return !m_stackingNode->hasNegativeZOrderList();
 }
 
 void PaintLayer::ensureCompositedLayerMapping()
 {
     if (m_rareData && m_rareData->compositedLayerMapping)
         return;
 
     ensureRareData().compositedLayerMapping = wrapUnique(new CompositedLayerMapping(*this));
     m_rareData->compositedLayerMapping->setNeedsGraphicsLayerUpdate(GraphicsLayerUpdateSubtree);
 
@@ skipping 623 matching lines @@
 
 void showLayerTree(const blink::LayoutObject* layoutObject)
 {
     if (!layoutObject) {
         fprintf(stderr, "Cannot showLayerTree. Root is (nil)\n");
         return;
     }
     showLayerTree(layoutObject->enclosingLayer());
 }
 #endif