[SPInvalidation] Ensure paint invalidation flags are cleared

third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp

Index: third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
diff --git a/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp b/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
index cb3e4a72c3452cbf7f451e51d321cb60d67c401e..83ebd785bdce76b3621a14e01a18a264c8db71fe 100644
--- a/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
+++ b/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
@@ -44,12 +44,18 @@ void PrePaintTreeWalk::walk(FrameView& frameView,
   m_propertyTreeBuilder.buildTreeNodes(frameView,
                                        localContext.treeBuilderContext);
 
-  if (RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled())
+  if (RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled()) {
     m_paintInvalidator.invalidatePaintIfNeeded(
         frameView, localContext.paintInvalidatorContext);
+  }
 
   if (LayoutView* layoutView = frameView.layoutView())
     walk(*layoutView, localContext);
+
+#if DCHECK_IS_ON()
+  if (RuntimeEnabledFeatures::slimmingPaintInvalidationEnabled())
+    frameView.layoutView()->assertSubtreeClearedPaintInvalidationFlags();
+#endif
 }
 
 void PrePaintTreeWalk::walk(const LayoutObject& object,
@@ -62,6 +68,7 @@ void PrePaintTreeWalk::walk(const LayoutObject& object,
     // positioned descendants if their containers are between the multi-column
     // container and the spanner. See PaintPropertyTreeBuilder for details.
     localContext.treeBuilderContext.isUnderMultiColumnSpanner = true;
+    object.getMutableForPainting().clearPaintInvalidationFlags();
     walk(*toLayoutMultiColumnSpannerPlaceholder(object)
               .layoutObjectInFlowThread(),
          localContext);