RAL: Eliminate n^2 walk to find repaint containers

Source/core/rendering/RenderBlock.cpp

Index: Source/core/rendering/RenderBlock.cpp
diff --git a/Source/core/rendering/RenderBlock.cpp b/Source/core/rendering/RenderBlock.cpp
index 6236af469fc215673ba017bf059b37b293c38de4..0a22a55734157db1321c1ccf09dbf7b8cedd7434 100644
--- a/Source/core/rendering/RenderBlock.cpp
+++ b/Source/core/rendering/RenderBlock.cpp
@@ -360,19 +360,23 @@ void RenderBlock::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
         ResourceLoadPriorityOptimizer::resourceLoadPriorityOptimizer()->addRenderObject(this);
 }
 
-void RenderBlock::repaintTreeAfterLayout()
+void RenderBlock::repaintTreeAfterLayout(RenderLayerModelObject& repaintContainer)
 {
     if (!shouldCheckForInvalidationAfterLayout())
         return;
 
-    RenderBox::repaintTreeAfterLayout();
+    RenderBox::repaintTreeAfterLayout(repaintContainer);
 
     // Take care of positioned objects. This is required as LayoutState keeps a single clip rect.
     if (TrackedRendererListHashSet* positionedObjects = this->positionedObjects()) {
         TrackedRendererListHashSet::iterator end = positionedObjects->end();
         LayoutStateMaintainer statePusher(*this, isTableRow() ? LayoutSize() : locationOffset());
-        for (TrackedRendererListHashSet::iterator it = positionedObjects->begin(); it != end; ++it)
-            (*it)->repaintTreeAfterLayout();
+        for (TrackedRendererListHashSet::iterator it = positionedObjects->begin(); it != end; ++it) {
+            // One of the renderers we're skipping over here may be the child's repaint container,
+            // so we can't pass our own repaint container along.
+            RenderLayerModelObject* repaintContainerForChild = (*it)->containerForRepaint();

[Julien - ping for review, 2014/05/07 17:50:03]

That's kind of crazy that a positioned element doesn't paint into its containing
block or an ancestor of it. It sounds like we could end up improperly painting
due to that.

[leviw_travelin_and_unemployed, 2014/05/07 17:58:48]

Super weird, I agree.

[Ian Vollick, 2014/05/07 22:55:58]

Oh, that is strange. I wonder what bugs this is currently causing..

[eseidel, 2014/05/08 00:43:02]

I'm not sure it is odd.  But I admit to not fully keeping painting in my head. 
http://www.w3.org/TR/CSS2/zindex.html

On 2014/05/07 22:55:58, Ian Vollick wrote:

[ojan, 2014/05/10 17:43:12]

In theory, all the positioned objects in this loop should have the same repaint
container, right? Can we just call containerForRepaint once outside the loop?

[ojan, 2014/05/10 18:02:31]

Hmmm. I guess the repaint container would be different for different position
values. In either case, we'd only need to call conatinerForRepaint once per
position value we encounter.

+            (*it)->repaintTreeAfterLayout(*repaintContainerForChild);
+        }
     }
 }