[SPInvalidation] Fix PrePaintTreeWalk for multicol spanner

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilderTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/LayoutTestHelper.h"
 #include "core/layout/LayoutTreeAsText.h"
 #include "core/layout/api/LayoutViewItem.h"
 #include "core/paint/ObjectPaintProperties.h"
 #include "core/paint/PaintPropertyTreePrinter.h"
 #include "platform/graphics/paint/GeometryMapper.h"
@@ skipping 53 matching lines @@
     return frameView->contentClip();
   }
 
   const ScrollPaintPropertyNode* frameScroll() {
     FrameView* frameView = document().view();
     if (RuntimeEnabledFeatures::rootLayerScrollingEnabled())
       return frameView->layoutView()->objectPaintProperties()->scroll();
     return frameView->scroll();
   }
 
+  LayoutPoint paintOffset(const LayoutObject* object) {
+    return object->objectPaintProperties()
+        ->localBorderBoxProperties()
+        ->paintOffset;
+  }
+
  private:
   void SetUp() override {
     Settings::setMockScrollbarsEnabled(true);
 
     RenderingTest::SetUp();
     enableCompositing();
   }
 
   void TearDown() override {
     RenderingTest::TearDown();
@@ skipping 2696 matching lines @@
               MainThreadScrollingReason::kHasBackgroundAttachmentFixedObjects));
   EXPECT_FALSE(
       overflowB->layoutObject()
           ->objectPaintProperties()
           ->scroll()
           ->parent()
           ->hasMainThreadScrollingReasons(
               MainThreadScrollingReason::kHasBackgroundAttachmentFixedObjects));
 }
 
+TEST_P(PaintPropertyTreeBuilderTest, PaintOffsetsUnderMultiColumn) {
+  setBodyInnerHTML(
+      "<style>"
+      "  body { margin: 0; }"
+      "  .space { height: 30px; }"
+      "  .abs { position: absolute; width: 20px; height: 20px; }"
+      "</style>"
+      "<div style='columns:2; width: 200px; column-gap: 0'>"
+      "  <div style='position: relative'>"
+      "    <div id=space1 class=space></div>"
+      "    <div id=space2 class=space></div>"
+      "    <div id=spanner style='column-span: all'>"
+      "      <div id=normal style='height: 50px'></div>"
+      "      <div id=top-left class=abs style='top: 0; left: 0'></div>"
+      "      <div id=bottom-right class=abs style='bottom: 0; right: 0'></div>"
+      "    </div>"
+      "    <div id=space3 class=space></div>"
+      "    <div id=space4 class=space></div>"
+      "  </div>"
+      "</div>");
+
+  // Above the spanner.
+  // Column 1.
+  EXPECT_EQ(LayoutPoint(), paintOffset(getLayoutObjectByElementId("space1")));
+  // Column 2. TODO(crbug.com/648274): This is incorrect. Should be (100, 0).
+  EXPECT_EQ(LayoutPoint(0, 30),
+            paintOffset(getLayoutObjectByElementId("space2")));
+
+  // The spanner's normal flow.
+  EXPECT_EQ(LayoutPoint(0, 30),
+            paintOffset(getLayoutObjectByElementId("spanner")));
+  EXPECT_EQ(LayoutPoint(0, 30),
+            paintOffset(getLayoutObjectByElementId("normal")));
+
+  // Below the spanner.
+  // Column 1. TODO(crbug.com/648274): This is incorrect. Should be (0, 80).
+  EXPECT_EQ(LayoutPoint(0, 60),
+            paintOffset(getLayoutObjectByElementId("space3")));
+  // Column 2. TODO(crbug.com/648274): This is incorrect. Should be (100, 80).
+  EXPECT_EQ(LayoutPoint(0, 90),
+            paintOffset(getLayoutObjectByElementId("space4")));
+
+  // Out-of-flow positioned descendants of the spanner. They are laid out in
+  // the relative-position container.
+
+  // "top-left" should be aligned to the top-left corner of space1.
+  EXPECT_EQ(LayoutPoint(0, 0),
+            paintOffset(getLayoutObjectByElementId("top-left")));
+
+  // "bottom-right" should be aligned to the bottom-right corner of space4.
+  // TODO(crbug.com/648274): This is incorrect. Should be (180, 90).
+  EXPECT_EQ(LayoutPoint(80, 100),
+            paintOffset(getLayoutObjectByElementId("bottom-right")));
+}
+
+// Ensures no crash with multi-column containing relative-position inline with
+// spanner with absolute-position children.
+TEST_P(PaintPropertyTreeBuilderTest,
+       MultiColumnInlineRelativeAndSpannerAndAbsPos) {
+  setBodyInnerHTML(
+      "<div style='columns:2; width: 200px; column-gap: 0'>"
+      "  <span style='position: relative'>"
+      "    <span id=spanner style='column-span: all'>"
+      "      <div id=absolute style='position: absolute'>absolute</div>"
+      "    </span>"
+      "  </span>"
+      "</div>");
+  // The "spanner" isn't a real spanner because it's an inline.
+  EXPECT_FALSE(getLayoutObjectByElementId("spanner")->isColumnSpanAll());
+
+  setBodyInnerHTML(
+      "<div style='columns:2; width: 200px; column-gap: 0'>"
+      "  <span style='position: relative'>"
+      "    <div id=spanner style='column-span: all'>"
+      "      <div id=absolute style='position: absolute'>absolute</div>"
+      "    </div>"
+      "  </span>"
+      "</div>");
+  // There should be anonymous block created containing the inline "relative",
+  // serving as the container of "absolute".
+  EXPECT_TRUE(
+      getLayoutObjectByElementId("absolute")->container()->isLayoutBlock());
+}
 }  // namespace blink