[SPInvalidation] Fix PrePaintTreeWalk for multicol spanner

third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp

Index: third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
diff --git a/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp b/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
index 582e8cb0846d910ff4a08ea66cfdc6869475143f..117b0ecfea6a15dbc95ba4f184743333ab9ebab3 100644
--- a/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
+++ b/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
@@ -56,6 +56,17 @@ void PrePaintTreeWalk::walk(const LayoutObject& object,
                             const PrePaintTreeWalkContext& context) {
   PrePaintTreeWalkContext localContext(context);
 
+  if (object.isLayoutMultiColumnSpannerPlaceholder()) {
+    // Multi-column spanner should be walked for normal flow descendants from
+    // the placeholder. Set the flag so that the tree builder can specially
+    // handle the out-of-flow positioned descendants.
+    localContext.treeBuilderContext.isUnderMultiColumnSpanner = true;

[mstensho (USE GERRIT), 2016/10/05 08:44:09]

<div style="columns:3;">
  <div id="rel" style="position:relative;">
    <div id="spanner" style="columns-span:all;">
       <div id="abs" style="position:absolute;"></div>
    </div>
  </div>
</div>

The containing block of #abs is #rel. As such, #abs escapes #spanner and becomes
out-of-flow multicol content, and not part of the spanner.

So if isUnderMultiColumnSpanner is true at #abs, I guess it's a problem.

Here, on the other hand:

<div style="columns:3;">
  <div id="relspanner" style="columns-span:all;">
     <div id="abs" style="position:absolute;"></div>
  </div>
</div>

The containing block of #abs is #relspanner, so here #abs lives inside the
spanner.

[Xianzhu, 2016/10/05 17:29:40]

Yes. Updated comments here and PaintPropertyTreeBuilder to state that the
special case may or may not happen and the special handling applies is for the
special case only.

+    walk(*toLayoutMultiColumnSpannerPlaceholder(object)
+              .layoutObjectInFlowThread(),
+         localContext);
+    return;
+  }
+
   m_propertyTreeBuilder.buildTreeNodesForSelf(object,
                                               localContext.treeBuilderContext);
   if (RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled())
@@ -66,17 +77,12 @@ void PrePaintTreeWalk::walk(const LayoutObject& object,
 
   for (const LayoutObject* child = object.slowFirstChild(); child;
        child = child->nextSibling()) {
-    // Column spanners are walked through their placeholders. See below.
+    // Column spanners are walked through their placeholders. See above.
     if (child->isColumnSpanAll())
       continue;
     walk(*child, localContext);
   }
 
-  if (object.isLayoutMultiColumnSpannerPlaceholder())
-    walk(*toLayoutMultiColumnSpannerPlaceholder(object)
-              .layoutObjectInFlowThread(),
-         localContext);
-
   if (object.isLayoutPart()) {
     const LayoutPart& layoutPart = toLayoutPart(object);
     Widget* widget = layoutPart.widget();