[SPInvalidation] Fix PrePaintTreeWalk for multicol spanner

third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp

Index: third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
diff --git a/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp b/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
index 582e8cb0846d910ff4a08ea66cfdc6869475143f..cb3e4a72c3452cbf7f451e51d321cb60d67c401e 100644
--- a/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
+++ b/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
@@ -56,6 +56,18 @@ void PrePaintTreeWalk::walk(const LayoutObject& object,
                             const PrePaintTreeWalkContext& context) {
   PrePaintTreeWalkContext localContext(context);
 
+  if (object.isLayoutMultiColumnSpannerPlaceholder()) {
+    // Walk multi-column spanner as if it replaces the placeholder.
+    // Set the flag so that the tree builder can specially handle out-of-flow
+    // positioned descendants if their containers are between the multi-column
+    // container and the spanner. See PaintPropertyTreeBuilder for details.
+    localContext.treeBuilderContext.isUnderMultiColumnSpanner = true;
+    walk(*toLayoutMultiColumnSpannerPlaceholder(object)
+              .layoutObjectInFlowThread(),
+         localContext);
+    return;
+  }
+
   m_propertyTreeBuilder.buildTreeNodesForSelf(object,
                                               localContext.treeBuilderContext);
   if (RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled())
@@ -66,17 +78,12 @@ void PrePaintTreeWalk::walk(const LayoutObject& object,
 
   for (const LayoutObject* child = object.slowFirstChild(); child;
        child = child->nextSibling()) {
-    // Column spanners are walked through their placeholders. See below.
+    // Column spanners are walked through their placeholders. See above.
     if (child->isColumnSpanAll())
       continue;
     walk(*child, localContext);
   }
 
-  if (object.isLayoutMultiColumnSpannerPlaceholder())
-    walk(*toLayoutMultiColumnSpannerPlaceholder(object)
-              .layoutObjectInFlowThread(),
-         localContext);
-
   if (object.isLayoutPart()) {
     const LayoutPart& layoutPart = toLayoutPart(object);
     Widget* widget = layoutPart.widget();