[SPInvalidation] Workaround bug about out-of-flow positioned under column spanner

third_party/WebKit/Source/core/paint/PaintInvalidator.cpp

Index: third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp b/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
index 16d3f4c0419858cce1c81f34b2bdf2e41ddb3c06..47ef71c74eebf919da0864f3e618aaae895a540f 100644
--- a/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
@@ -328,9 +328,13 @@ void PaintInvalidator::updateContext(const LayoutObject& object,
   // TODO(crbug.com/637313): This is temporary before we support filters in
   // paint property tree.
   // TODO(crbug.com/648274): This is a workaround for multi-column contents.
-  if (object.hasFilterInducingProperty() || object.isLayoutFlowThread())
+  // TODO(crbug.com/672989): This is a workaround for out-of-flow positioned
+  // objects in multi-column spanner.
+  if (object.hasFilterInducingProperty() || object.isLayoutFlowThread() ||
+      object.isColumnSpanAll()) {
     context.forcedSubtreeInvalidationFlags |=
         PaintInvalidatorContext::ForcedSubtreeSlowPathRect;
+  }
 
   ObjectPaintInvalidator objectPaintInvalidator(object);
   context.oldVisualRect = object.previousVisualRect();