Fix geometry mapping issues for float under inline

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

Index: third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
index daad53c7bd927931e14cb6edae7f2f62659eb14a..1af73e9cdb99d21fa053549d446852ff07a62b51 100644
--- a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
@@ -751,9 +751,12 @@ void PaintPropertyTreeBuilder::updateScrollAndScrollTranslation(
   }
 }
 
-void PaintPropertyTreeBuilder::updateOutOfFlowContext(
+void PaintPropertyTreeBuilder::updateOutOfFlowAndFloatContext(
     const LayoutObject& object,
     PaintPropertyTreeBuilderContext& context) {
+  if (object.isLayoutBlock())
+    context.paintOffsetForFloat = context.current.paintOffset;
+
   if (object.canContainAbsolutePositionObjects()) {
     context.absolutePosition = context.current;
     context.containerForAbsolutePosition = &object;
@@ -848,6 +851,10 @@ void PaintPropertyTreeBuilder::updateContextForBoxPosition(
     return;
 
   const LayoutBoxModelObject& boxModelObject = toLayoutBoxModelObject(object);
+
+  if (boxModelObject.isFloating())
+    context.current.paintOffset = context.paintOffsetForFloat;
+
   switch (object.styleRef().position()) {
     case StaticPosition:
       break;
@@ -955,7 +962,7 @@ void PaintPropertyTreeBuilder::updatePropertiesForChildren(
   updatePerspective(object, context);
   updateSvgLocalToBorderBoxTransform(object, context);
   updateScrollAndScrollTranslation(object, context);
-  updateOutOfFlowContext(object, context);
+  updateOutOfFlowAndFloatContext(object, context);
 }
 
 }  // namespace blink