[SPInvalidation] Fix PrePaintTreeWalk for multicol spanner

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

Index: third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
index 5a627a037a844570a70db6d54df4fbe64439033e..8fc58a2df241fa1387dd9efc2d6d382909edbc7c 100644
--- a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
@@ -658,6 +658,26 @@ void PaintPropertyTreeBuilder::updateOutOfFlowContext(
     properties->clearCssClipFixedPosition();
 }
 
+// Override ContainerContext for normal tree-walk from a container that was
+// previously walked in a subtree other than the current subtree being walked.
+// Used for out-of-flow positioned descendants of multi-column spanner, whose
+// containers may be not be in the normal tree walk order.
+static void overrideContainerContextFromContainer(
+    const LayoutObject& container,
+    PaintPropertyTreeBuilderContext::ContainerContext& context) {
+  const auto* properties =
+      container.objectPaintProperties()->localBorderBoxProperties();

[chrishtr, 2016/10/05 00:48:17]

DCHECK(properties && container.isBox())

[Xianzhu, 2016/10/05 17:29:40]

Done.

+  context.transform = properties->propertyTreeState.transform();
+  context.paintOffset = properties->paintOffset;
+  context.shouldFlattenInheritedTransform =
+      context.transform && context.transform->flattensInheritedTransform();
+  context.renderingContextID =
+      context.transform ? context.transform->renderingContextID() : 0;
+  context.clip = properties->propertyTreeState.clip();
+  context.scroll = const_cast<ScrollPaintPropertyNode*>(
+      properties->propertyTreeState.scroll());
+}
+
 static void deriveBorderBoxFromContainerContext(
     const LayoutObject& object,
     PaintPropertyTreeBuilderContext& context) {
@@ -673,7 +693,20 @@ static void deriveBorderBoxFromContainerContext(
       context.current.paintOffset += boxModelObject.offsetForInFlowPosition();
       break;
     case AbsolutePosition: {
-      context.current = context.absolutePosition;
+      if (context.isUnderMultiColumnSpanner) {
+        // The container of the absolute-position object may be not in the
+        // normal tree-walk order.
+        const LayoutObject* container = boxModelObject.container();
+        if (container != context.containerForAbsolutePosition) {
+          context.containerForAbsolutePosition =
+              toLayoutBoxModelObject(container);
+          overrideContainerContextFromContainer(*container, context.current);
+        }
+      } else {
+        DCHECK(context.containerForAbsolutePosition ==
+               boxModelObject.container());
+        context.current = context.absolutePosition;
+      }
 
       // Absolutely positioned content in an inline should be positioned relative to the inline.
       const LayoutObject* container = context.containerForAbsolutePosition;
@@ -690,7 +723,14 @@ static void deriveBorderBoxFromContainerContext(
       context.current.paintOffset += boxModelObject.offsetForInFlowPosition();
       break;
     case FixedPosition:
-      context.current = context.fixedPosition;
+      if (context.isUnderMultiColumnSpanner) {
+        // The container of the fixed-position object may be not in the normal
+        // tree-walk order.
+        overrideContainerContextFromContainer(*boxModelObject.container(),
+                                              context.current);
+      } else {
+        context.current = context.fixedPosition;
+      }
       break;
     default:
       ASSERT_NOT_REACHED();