[SPInvalidation] Ensure paint invalidation flags are cleared

third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp

Index: third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
diff --git a/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp b/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
index cb3e4a72c3452cbf7f451e51d321cb60d67c401e..83ebd785bdce76b3621a14e01a18a264c8db71fe 100644
--- a/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
+++ b/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
@@ -44,12 +44,18 @@ void PrePaintTreeWalk::walk(FrameView& frameView,
   m_propertyTreeBuilder.buildTreeNodes(frameView,
                                        localContext.treeBuilderContext);
 
-  if (RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled())
+  if (RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled()) {
     m_paintInvalidator.invalidatePaintIfNeeded(
         frameView, localContext.paintInvalidatorContext);
+  }
 
   if (LayoutView* layoutView = frameView.layoutView())
     walk(*layoutView, localContext);
+
+#if DCHECK_IS_ON()
+  if (RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled())
+    frameView.layoutView()->assertSubtreeClearedPaintInvalidationFlags();
+#endif
 }
 
 void PrePaintTreeWalk::walk(const LayoutObject& object,
@@ -62,6 +68,7 @@ void PrePaintTreeWalk::walk(const LayoutObject& object,
     // positioned descendants if their containers are between the multi-column
     // container and the spanner. See PaintPropertyTreeBuilder for details.
     localContext.treeBuilderContext.isUnderMultiColumnSpanner = true;
+    object.getMutableForPainting().clearPaintInvalidationFlags();

[chrishtr, 2016/10/11 22:12:42]

The incorrect flags would have been set by parents which are not really the
parents?

Also, could you point me to the corresponding code in SPv1?

[Xianzhu, 2016/10/11 22:37:21]

No, we just missed clearing paint invalidation flags of the placeholder.
In SPv1, we don't have special handling about placeholders and spanners. We just
walk them in normal layout tree order. For placeholder, the normal
LayoutObject::invalidatePaintIfNeeded() is called which issues no paint
invalidation and clear the paint invalidation flags. For spanner, we force slow
path rect mapping so don't need to care about the paint offset.

For slimmingPaintInvalidation, we need to follow the logical tree order
(placeholder -> spanner) and skip the placeholder to avoid the paint offset from
being calculated twice (because the placeholder and the spanner has the same
geometries, and the placeholder's parent is actually the logical parent of the
spanner). We should not skip clearing paint invalidation flags anyway.

     walk(*toLayoutMultiColumnSpannerPlaceholder(object)
               .layoutObjectInFlowThread(),
          localContext);