[SPInvalidation] Fix PrePaintTreeWalk for multicol spanner

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintPropertyTreeBuilder.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 640 matching lines @@
                   cssClip->clipRect());
       return;
     }
   }
 
   if (ObjectPaintProperties* properties =
           object.getMutableForPainting().objectPaintProperties())
     properties->clearCssClipFixedPosition();
 }
 
+// Override ContainerContext based on the properties of a container that was
+// previously walked in a subtree other than the current subtree being walked.
+// Used for out-of-flow positioned descendants of multi-column spanner when
+// the container is not in the normal tree walk order.
+// For example:
+// <div id="columns" style="columns: 2">
+//   <div id="relative" style="position: relative">
+//     <div id="spanner" style="column-span: all">
+//       <div id="absolute" style="position: absolute"></div>
+//     </div>
+//   </div>
+// <div>
+// The real container of "absolute" is "relative" which is not in the tree-walk
+// order of "columns" -> spanner placeholder -> spanner -> absolute. Here we
+// rebuild a ContainerContext based on the properties of "relative" for
+// "absolute".
+static void overrideContainerContextFromContainer(
+    const LayoutObject& container,
+    PaintPropertyTreeBuilderContext::ContainerContext& context) {
+  // The container is never a LayoutInline. In the above example, if we change
+  // the container to an inline, there must be an anonymous blocks created
+  // because the spanner is always a block.
+  DCHECK(container.isLayoutBlock());
+
+  const auto* properties =
+      container.objectPaintProperties()->localBorderBoxProperties();
+  DCHECK(properties);
+
+  context.transform = properties->propertyTreeState.transform();
+  context.paintOffset = properties->paintOffset;
+  context.shouldFlattenInheritedTransform =
+      context.transform && context.transform->flattensInheritedTransform();
+  context.renderingContextID =
+      context.transform ? context.transform->renderingContextID() : 0;
+  context.clip = properties->propertyTreeState.clip();
+  context.scroll = const_cast<ScrollPaintPropertyNode*>(
+      properties->propertyTreeState.scroll());
+}
+
 static void deriveBorderBoxFromContainerContext(
     const LayoutObject& object,
     PaintPropertyTreeBuilderContext& context) {
   if (!object.isBoxModelObject())
     return;
 
   const LayoutBoxModelObject& boxModelObject = toLayoutBoxModelObject(object);
 
   switch (object.styleRef().position()) {
     case StaticPosition:
       break;
     case RelativePosition:
       context.current.paintOffset += boxModelObject.offsetForInFlowPosition();
       break;
     case AbsolutePosition: {
-      context.current = context.absolutePosition;
+      if (context.isUnderMultiColumnSpanner) {
+        const LayoutObject* container = boxModelObject.container();
+        if (container != context.containerForAbsolutePosition) {
+          // The container of the absolute-position is not in the normal tree-
+          // walk order.
+          context.containerForAbsolutePosition =
+              toLayoutBoxModelObject(container);
+          overrideContainerContextFromContainer(*container, context.current);
+        }
+      } else {
+        DCHECK(context.containerForAbsolutePosition ==
+               boxModelObject.container());
+        context.current = context.absolutePosition;
+      }
 
-      // Absolutely positioned content in an inline should be positioned relative to the inline.
+      // Absolutely positioned content in an inline should be positioned
+      // relative to the inline.
       const LayoutObject* container = context.containerForAbsolutePosition;
       if (container && container->isInFlowPositioned() &&
           container->isLayoutInline()) {
         DCHECK(object.isBox());
         context.current.paintOffset +=
             toLayoutInline(container)->offsetForInFlowPositionedInline(
                 toLayoutBox(object));
       }
       break;
     }
     case StickyPosition:
       context.current.paintOffset += boxModelObject.offsetForInFlowPosition();
       break;
     case FixedPosition:
-      context.current = context.fixedPosition;
+      if (context.isUnderMultiColumnSpanner) {
+        // The container of the fixed-position object may or may not be in the
+        // normal tree-walk order.
+        overrideContainerContextFromContainer(*boxModelObject.container(),
+                                              context.current);
+      } else {
+        context.current = context.fixedPosition;
+      }
       break;
     default:
       ASSERT_NOT_REACHED();
   }
 
   // SVGForeignObject needs paint offset because its viewport offset is baked into its location(),
   // while its localSVGTransform() doesn't contain the offset.
   if (boxModelObject.isBox() &&
       (!boxModelObject.isSVG() || boxModelObject.isSVGRoot() ||
        boxModelObject.isSVGForeignObject())) {
@@ skipping 38 matching lines @@
     return;
 
   updateOverflowClip(object, context);
   updatePerspective(object, context);
   updateSvgLocalToBorderBoxTransform(object, context);
   updateScrollAndScrollTranslation(object, context);
   updateOutOfFlowContext(object, context);
 }
 
 }  // namespace blink