[SPInvalidation] Workaround bug about out-of-flow positioned under column spanner

third_party/WebKit/Source/core/paint/PaintInvalidator.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintInvalidator.h"
 
 #include "core/editing/FrameSelection.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
@@ skipping 310 matching lines @@
          object.containerForPaintInvalidation());
   DCHECK(context.paintingLayer == object.paintingLayer());
 
   if (object.mayNeedPaintInvalidationSubtree())
     context.forcedSubtreeInvalidationFlags |=
         PaintInvalidatorContext::ForcedSubtreeInvalidationChecking;
 
   // TODO(crbug.com/637313): This is temporary before we support filters in
   // paint property tree.
   // TODO(crbug.com/648274): This is a workaround for multi-column contents.
-  if (object.hasFilterInducingProperty() || object.isLayoutFlowThread())
+  // TODO(crbug.com/672989): This is a workaround for out-of-flow positioned
+  // objects in multi-column spanner.
+  if (object.hasFilterInducingProperty() || object.isLayoutFlowThread() ||
+      object.isColumnSpanAll()) {
     context.forcedSubtreeInvalidationFlags |=
         PaintInvalidatorContext::ForcedSubtreeSlowPathRect;
+  }
 
   ObjectPaintInvalidator objectPaintInvalidator(object);
   context.oldVisualRect = object.previousVisualRect();
   context.oldLocation = objectPaintInvalidator.previousLocationInBacking();
   context.newVisualRect = computeVisualRectInBacking(object, context);
   context.newLocation = computeLocationInBacking(object, context);
   context.oldPaintOffset = object.previousPaintOffset();
   context.newPaintOffset = context.treeBuilderContext.current.paintOffset;
 
   IntSize adjustment = object.scrollAdjustmentForPaintInvalidation(
@@ skipping 94 matching lines @@
         PaintInvalidatorContext::ForcedSubtreeInvalidationRectUpdate;
 }
 
 void PaintInvalidator::processPendingDelayedPaintInvalidations() {
   for (auto target : m_pendingDelayedPaintInvalidations)
     target->getMutableForPainting().setShouldDoFullPaintInvalidation(
         PaintInvalidationDelayedFull);
 }
 
 }  // namespace blink