Fix traverseNonCompositingDescendantsInPaintOrder for float-under-inline cases

third_party/WebKit/Source/core/paint/ObjectPaintInvalidator.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/ObjectPaintInvalidator.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/layout/LayoutView.h"
 #include "core/layout/api/LayoutPartItem.h"
@@ skipping 39 matching lines @@
          selectionVisualRectMap().contains(&object));
   if (object.hasPreviousSelectionVisualRect())
     selectionVisualRectMap().remove(&object);
 
   DCHECK(object.hasPreviousLocationInBacking() ==
          locationInBackingMap().contains(&object));
   if (object.hasPreviousLocationInBacking())
     locationInBackingMap().remove(&object);
 }
 
-// TODO(trchen): Use std::function<void, LayoutObject&> when available.
-template <typename LayoutObjectTraversalFunctor>
-void traverseNonCompositingDescendantsInPaintOrder(
+using LayoutObjectTraversalFunctor = std::function<void(const LayoutObject&)>;
+
+static void traverseNonCompositingDescendantsInPaintOrder(
     const LayoutObject&,
     const LayoutObjectTraversalFunctor&);
 
-template <typename LayoutObjectTraversalFunctor>
-void traverseNonCompositingDescendantsBelongingToAncestorPaintInvalidationContainer(
+static void
+traverseNonCompositingDescendantsBelongingToAncestorPaintInvalidationContainer(
     const LayoutObject& object,
     const LayoutObjectTraversalFunctor& functor) {
-  // |object| is a paint invalidation container but is not a stacking context,
-  // so the paint invalidation container of stacked descendants don't belong to
-  // |object| but belong to an ancestor. This function traverses all such
-  // descendants.
+  // |object| is a paint invalidation container, but is not a stacking context
+  // or is a non-block, so the paint invalidation container of stacked
+  // descendants may not belong to |object| but belong to an ancestor. This
+  // function traverses all such descendants. See Case 1a and Case 2 below for
+  // details.
   DCHECK(object.isPaintInvalidationContainer() &&
-         !object.styleRef().isStackingContext());
+         (!object.styleRef().isStackingContext() || !object.isLayoutBlock()));
 
   LayoutObject* descendant = object.nextInPreOrder(&object);
   while (descendant) {
     if (!descendant->hasLayer() || !descendant->styleRef().isStacked()) {
       // Case 1: The descendant is not stacked (or is stacked but has not been
       // allocated a layer yet during style change), so either it's a paint
       // invalidation container in the same situation as |object|, or its paint
       // invalidation container is in such situation. Keep searching until a
       // stacked layer is found.
-      descendant = descendant->nextInPreOrder(&object);
+      if (!object.isLayoutBlock() && descendant->isFloating()) {
+        // Case 1a (rare): However, if the descendant is a floating object below
+        // a composited non-block object, the subtree may belong to an ancestor
+        // in paint order, thus recur into the subtree. Note that for
+        // performance, we don't check whether the floating object's container
+        // is above or under |object|, so we may traverse more than expected.
+        // Example:
+        // <span id="object" class="position: relative; will-change: transform">
+        //   <div id="descendant" class="float: left"></div>"
+        // </span>
+        traverseNonCompositingDescendantsInPaintOrder(*descendant, functor);
+        descendant = descendant->nextInPreOrderAfterChildren(&object);
+      } else {
+        descendant = descendant->nextInPreOrder(&object);
+      }
     } else if (!descendant->isPaintInvalidationContainer()) {
       // Case 2: The descendant is stacked and is not composited.
       // The invalidation container of its subtree is our ancestor,
       // thus recur into the subtree.
       traverseNonCompositingDescendantsInPaintOrder(*descendant, functor);
       descendant = descendant->nextInPreOrderAfterChildren(&object);
-    } else if (descendant->styleRef().isStackingContext()) {
+    } else if (descendant->styleRef().isStackingContext() &&
+               descendant->isLayoutBlock()) {
       // Case 3: The descendant is an invalidation container and is a stacking
       // context.  No objects in the subtree can have invalidation container
       // outside of it, thus skip the whole subtree.
+      // This excludes non-block because there might be floating objects under
+      // the descendant belonging to some ancestor in paint order (Case 1a).
       descendant = descendant->nextInPreOrderAfterChildren(&object);
     } else {
       // Case 4: The descendant is an invalidation container but not a stacking
-      // context.  This is the same situation as |object|, thus keep searching.
+      // context, or the descendant is a non-block stacking context.
+      // This is the same situation as |object|, thus keep searching.
       descendant = descendant->nextInPreOrder(&object);
     }
   }
 }
 
-template <typename LayoutObjectTraversalFunctor>
-void traverseNonCompositingDescendantsInPaintOrder(
+static void traverseNonCompositingDescendantsInPaintOrder(
     const LayoutObject& object,
     const LayoutObjectTraversalFunctor& functor) {
   functor(object);
   LayoutObject* descendant = object.nextInPreOrder(&object);
   while (descendant) {
     if (!descendant->isPaintInvalidationContainer()) {
       functor(*descendant);
       descendant = descendant->nextInPreOrder(&object);
-    } else if (descendant->styleRef().isStackingContext()) {
+    } else if (descendant->styleRef().isStackingContext() &&
+               descendant->isLayoutBlock()) {
       // The descendant is an invalidation container and is a stacking context.
       // No objects in the subtree can have invalidation container outside of
       // it, thus skip the whole subtree.
+      // This excludes non-blocks because there might be floating objects under
+      // the descendant belonging to some ancestor in paint order (Case 1a).
       descendant = descendant->nextInPreOrderAfterChildren(&object);
     } else {
-      // If a paint invalidation container is not a stacking context,
-      // some of its descendants may belong to the parent container.
+      // If a paint invalidation container is not a stacking context, or the
+      // descendant is a non-block stacking context, some of its descendants may
+      // belong to the parent container.
       traverseNonCompositingDescendantsBelongingToAncestorPaintInvalidationContainer(
           *descendant, functor);
       descendant = descendant->nextInPreOrderAfterChildren(&object);
     }
   }
 }
 
+static void setPaintingLayerNeedsRepaintDuringTraverse(
+    const LayoutObject& object) {
+  if (object.hasLayer() &&
+      toLayoutBoxModelObject(object).hasSelfPaintingLayer()) {
+    toLayoutBoxModelObject(object).layer()->setNeedsRepaint();
+  } else if (object.isFloating() && object.parent() &&
+             !object.parent()->isLayoutBlock()) {
+    object.paintingLayer()->setNeedsRepaint();
+  }
+}
+
 void ObjectPaintInvalidator::
     invalidateDisplayItemClientsIncludingNonCompositingDescendants(
         PaintInvalidationReason reason) {
   // This is valid because we want to invalidate the client in the display item
   // list of the current backing.
   DisableCompositingQueryAsserts disabler;
 
   slowSetPaintingLayerNeedsRepaint();
   traverseNonCompositingDescendantsInPaintOrder(
       m_object, [reason](const LayoutObject& object) {
-        if (object.hasLayer() &&
-            toLayoutBoxModelObject(object).hasSelfPaintingLayer())
-          toLayoutBoxModelObject(object).layer()->setNeedsRepaint();
+        setPaintingLayerNeedsRepaintDuringTraverse(object);
         object.invalidateDisplayItemClients(reason);
       });
 }
 
 DISABLE_CFI_PERF
 void ObjectPaintInvalidator::invalidatePaintOfPreviousVisualRect(
     const LayoutBoxModelObject& paintInvalidationContainer,
     PaintInvalidationReason reason) {
   // It's caller's responsibility to ensure enclosingSelfPaintingLayer's
   // needsRepaint is set.  Don't set the flag here because getting
@@ skipping 17 matching lines @@
   // the new paint invalidation container happens to be the same as the old one.
   m_object.getMutableForPainting().clearPreviousVisualRects();
 }
 
 void ObjectPaintInvalidator::
     invalidatePaintIncludingNonCompositingDescendants() {
   // Since we're only painting non-composited layers, we know that they all
   // share the same paintInvalidationContainer.
   const LayoutBoxModelObject& paintInvalidationContainer =
       m_object.containerForPaintInvalidation();
+  slowSetPaintingLayerNeedsRepaint();
   traverseNonCompositingDescendantsInPaintOrder(
       m_object, [&paintInvalidationContainer](const LayoutObject& object) {
-        if (object.hasLayer())
-          toLayoutBoxModelObject(object).layer()->setNeedsRepaint();
+        setPaintingLayerNeedsRepaintDuringTraverse(object);
         ObjectPaintInvalidator(object).invalidatePaintOfPreviousVisualRect(
             paintInvalidationContainer, PaintInvalidationSubtree);
       });
 }
 
 void ObjectPaintInvalidator::
     invalidatePaintIncludingNonSelfPaintingLayerDescendantsInternal(
         const LayoutBoxModelObject& paintInvalidationContainer) {
   invalidatePaintOfPreviousVisualRect(paintInvalidationContainer,
                                       PaintInvalidationSubtree);
@@ skipping 379 matching lines @@
 
   m_context.paintingLayer->setNeedsRepaint();
   m_object.invalidateDisplayItemClients(reason);
   return reason;
 }
 
 DisablePaintInvalidationStateAsserts::DisablePaintInvalidationStateAsserts()
     : m_disabler(&gDisablePaintInvalidationStateAsserts, true) {}
 
 }  // namespace blink