[SPInvalidation] Fix PrePaintTreeWalk for multicol spanner

third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PrePaintTreeWalk.h"
 
 #include "core/dom/DocumentLifecycle.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/layout/LayoutMultiColumnSpannerPlaceholder.h"
@@ skipping 38 matching lines @@
         frameView, localContext.paintInvalidatorContext);
 
   if (LayoutView* layoutView = frameView.layoutView())
     walk(*layoutView, localContext);
 }
 
 void PrePaintTreeWalk::walk(const LayoutObject& object,
                             const PrePaintTreeWalkContext& context) {
   PrePaintTreeWalkContext localContext(context);
 
+  if (object.isLayoutMultiColumnSpannerPlaceholder()) {
+    // Multi-column spanner should be walked for normal flow descendants from
+    // the placeholder. Set the flag so that the tree builder can specially
+    // handle the out-of-flow positioned descendants.
+    localContext.treeBuilderContext.isUnderMultiColumnSpanner = true;

[mstensho (USE GERRIT), 2016/10/05 08:44:09]

<div style="columns:3;">
  <div id="rel" style="position:relative;">
    <div id="spanner" style="columns-span:all;">
       <div id="abs" style="position:absolute;"></div>
    </div>
  </div>
</div>

The containing block of #abs is #rel. As such, #abs escapes #spanner and becomes
out-of-flow multicol content, and not part of the spanner.

So if isUnderMultiColumnSpanner is true at #abs, I guess it's a problem.

Here, on the other hand:

<div style="columns:3;">
  <div id="relspanner" style="columns-span:all;">
     <div id="abs" style="position:absolute;"></div>
  </div>
</div>

The containing block of #abs is #relspanner, so here #abs lives inside the
spanner.

[Xianzhu, 2016/10/05 17:29:40]

Yes. Updated comments here and PaintPropertyTreeBuilder to state that the
special case may or may not happen and the special handling applies is for the
special case only.

+    walk(*toLayoutMultiColumnSpannerPlaceholder(object)
+              .layoutObjectInFlowThread(),
+         localContext);
+    return;
+  }
+
   m_propertyTreeBuilder.buildTreeNodesForSelf(object,
                                               localContext.treeBuilderContext);
   if (RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled())
     m_paintInvalidator.invalidatePaintIfNeeded(
         object, localContext.paintInvalidatorContext);
   m_propertyTreeBuilder.buildTreeNodesForChildren(
       object, localContext.treeBuilderContext);
 
   for (const LayoutObject* child = object.slowFirstChild(); child;
        child = child->nextSibling()) {
-    // Column spanners are walked through their placeholders. See below.
+    // Column spanners are walked through their placeholders. See above.
     if (child->isColumnSpanAll())
       continue;
     walk(*child, localContext);
   }
 
-  if (object.isLayoutMultiColumnSpannerPlaceholder())
-    walk(*toLayoutMultiColumnSpannerPlaceholder(object)
-              .layoutObjectInFlowThread(),
-         localContext);
-
   if (object.isLayoutPart()) {
     const LayoutPart& layoutPart = toLayoutPart(object);
     Widget* widget = layoutPart.widget();
     if (widget && widget->isFrameView()) {
       localContext.treeBuilderContext.current.paintOffset +=
           layoutPart.replacedContentRect().location() -
           widget->frameRect().location();
       localContext.treeBuilderContext.current.paintOffset =
           roundedIntPoint(localContext.treeBuilderContext.current.paintOffset);
       walk(*toFrameView(widget), localContext);
     }
     // TODO(pdr): Investigate RemoteFrameView (crbug.com/579281).
   }
 }
 
 }  // namespace blink