Fix PaintInvalidationState for multicol

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/PaintInvalidationState.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 218 matching lines @@
     return;
   }
 
   updateForCurrentObject(parentState);
 }
 
 PaintLayer& PaintInvalidationState::childPaintingLayer(
     const LayoutObject& child) const {
   if (child.hasLayer() && toLayoutBoxModelObject(child).hasSelfPaintingLayer())
     return *toLayoutBoxModelObject(child).layer();
-  // See LayoutObject::paintingLayer() for specialty of floating objects.
-  if (child.isFloating() && !m_currentObject.isLayoutBlock())
+  // See LayoutObject::paintingLayer() for the special-cases of floating under
+  // inline and multicolumn.
+  if (child.isColumnSpanAll() ||
+      (child.isFloating() && !m_currentObject.isLayoutBlock()))
     return *child.paintingLayer();
   return m_paintingLayer;
 }
 
 void PaintInvalidationState::updateForCurrentObject(
     const PaintInvalidationState& parentState) {
   if (!m_cachedOffsetsEnabled)
     return;
 
   if (m_currentObject.isLayoutView()) {
@@ skipping 387 matching lines @@
 }
 
 void PaintInvalidatorContextAdapter::mapLocalRectToPaintInvalidationBacking(
     const LayoutObject& object,
     LayoutRect& rect) const {
   DCHECK(&object == &m_paintInvalidationState.currentObject());
   m_paintInvalidationState.mapLocalRectToPaintInvalidationBacking(rect);
 }
 
 }  // namespace blink