[SPInvalidation] Fix PrePaintTreeWalk for multicol spanner

third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PrePaintTreeWalk.h"
 
 #include "core/dom/DocumentLifecycle.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/layout/LayoutMultiColumnSpannerPlaceholder.h"
@@ skipping 38 matching lines @@
         frameView, localContext.paintInvalidatorContext);
 
   if (LayoutView* layoutView = frameView.layoutView())
     walk(*layoutView, localContext);
 }
 
 void PrePaintTreeWalk::walk(const LayoutObject& object,
                             const PrePaintTreeWalkContext& context) {
   PrePaintTreeWalkContext localContext(context);
 
+  if (object.isLayoutMultiColumnSpannerPlaceholder()) {
+    // Walk multi-column spanner as if it replaces the placeholder.
+    // Set the flag so that the tree builder can specially handle out-of-flow
+    // positioned descendants if their containers are between the multi-column
+    // container and the spanner. See PaintPropertyTreeBuilder for details.
+    localContext.treeBuilderContext.isUnderMultiColumnSpanner = true;
+    walk(*toLayoutMultiColumnSpannerPlaceholder(object)
+              .layoutObjectInFlowThread(),
+         localContext);
+    return;
+  }
+
   m_propertyTreeBuilder.buildTreeNodesForSelf(object,
                                               localContext.treeBuilderContext);
   if (RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled())
     m_paintInvalidator.invalidatePaintIfNeeded(
         object, localContext.paintInvalidatorContext);
   m_propertyTreeBuilder.buildTreeNodesForChildren(
       object, localContext.treeBuilderContext);
 
   for (const LayoutObject* child = object.slowFirstChild(); child;
        child = child->nextSibling()) {
-    // Column spanners are walked through their placeholders. See below.
+    // Column spanners are walked through their placeholders. See above.
     if (child->isColumnSpanAll())
       continue;
     walk(*child, localContext);
   }
 
-  if (object.isLayoutMultiColumnSpannerPlaceholder())
-    walk(*toLayoutMultiColumnSpannerPlaceholder(object)
-              .layoutObjectInFlowThread(),
-         localContext);
-
   if (object.isLayoutPart()) {
     const LayoutPart& layoutPart = toLayoutPart(object);
     Widget* widget = layoutPart.widget();
     if (widget && widget->isFrameView()) {
       localContext.treeBuilderContext.current.paintOffset +=
           layoutPart.replacedContentRect().location() -
           widget->frameRect().location();
       localContext.treeBuilderContext.current.paintOffset =
           roundedIntPoint(localContext.treeBuilderContext.current.paintOffset);
       walk(*toFrameView(widget), localContext);
     }
     // TODO(pdr): Investigate RemoteFrameView (crbug.com/579281).
   }
 }
 
 }  // namespace blink