Fix geometry mapping issues for float under inline

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintPropertyTreeBuilder.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 733 matching lines @@
     }
   }
 
   if (object.paintProperties() && object.paintProperties()->scroll()) {
     context.current.transform = object.paintProperties()->scrollTranslation();
     context.current.scroll = object.paintProperties()->scroll();
     context.current.shouldFlattenInheritedTransform = false;
   }
 }
 
-void PaintPropertyTreeBuilder::updateOutOfFlowContext(
+void PaintPropertyTreeBuilder::updateOutOfFlowAndFloatContext(
     const LayoutObject& object,
     PaintPropertyTreeBuilderContext& context) {
+  if (object.isLayoutBlock())
+    context.paintOffsetForFloat = context.current.paintOffset;
+
   if (object.canContainAbsolutePositionObjects()) {
     context.absolutePosition = context.current;
     context.containerForAbsolutePosition = &object;
   }
 
   if (object.isLayoutView()) {
     if (RuntimeEnabledFeatures::rootLayerScrollingEnabled()) {
       const auto* initialFixedTransform = context.fixedPosition.transform;
       const auto* initialFixedScroll = context.fixedPosition.scroll;
 
@@ skipping 74 matching lines @@
   context.scroll = properties->propertyTreeState.scroll();
 }
 
 void PaintPropertyTreeBuilder::updateContextForBoxPosition(
     const LayoutObject& object,
     PaintPropertyTreeBuilderContext& context) {
   if (!object.isBoxModelObject())
     return;
 
   const LayoutBoxModelObject& boxModelObject = toLayoutBoxModelObject(object);
+
+  if (boxModelObject.isFloating())
+    context.current.paintOffset = context.paintOffsetForFloat;
+
   switch (object.styleRef().position()) {
     case StaticPosition:
       break;
     case RelativePosition:
       context.current.paintOffset += boxModelObject.offsetForInFlowPosition();
       break;
     case AbsolutePosition: {
       if (context.isUnderMultiColumnSpanner) {
         const LayoutObject* container = boxModelObject.container();
         if (container != context.containerForAbsolutePosition) {
@@ skipping 87 matching lines @@
     return;
 
 #if DCHECK_IS_ON()
   FindObjectPropertiesNeedingUpdateScope checkNeedsUpdateScope(object, context);
 #endif
 
   updateOverflowClip(object, context);
   updatePerspective(object, context);
   updateSvgLocalToBorderBoxTransform(object, context);
   updateScrollAndScrollTranslation(object, context);
-  updateOutOfFlowContext(object, context);
+  updateOutOfFlowAndFloatContext(object, context);
 }
 
 }  // namespace blink