Fix paint and rect mapping issues for stacked float under stacked inline

third_party/WebKit/Source/core/layout/LayoutObject.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2011 Apple Inc.
  *               All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved.
  *               (http://www.torchmobile.com/)
@@ skipping 595 matching lines @@
     if (current->hasLayer())
       return toLayoutBoxModelObject(current)->layer();
   }
   // TODO(crbug.com/365897): we should get rid of detached layout subtrees, at
   // which point this code should not be reached.
   return nullptr;
 }
 
 PaintLayer* LayoutObject::paintingLayer() const {
   for (const LayoutObject* current = this; current;
-       // Use containingBlock instead of paintInvalidationParent for floating
-       // object to omit any self-painting layers of inline objects that don't
-       // paint the floating object.
-       current = current->isFloating() ? current->containingBlock()
+       // Use container instead of paintInvalidationParent for floating object
+       // to omit any self-painting layers of inline objects that don't paint
+       // the floating object.
+       current = current->isFloating() ? current->container()
                                        : current->paintInvalidationParent()) {
     if (current->hasLayer() &&
         toLayoutBoxModelObject(current)->layer()->isSelfPaintingLayer()) {
       return toLayoutBoxModelObject(current)->layer();
     } else if (current->isColumnSpanAll()) {
       // Column spanners paint through their multicolumn containers which can
       // be accessed through the associated out-of-flow placeholder's parent.
       current = current->spannerPlaceholder();
     }
   }
@@ skipping 1831 matching lines @@
   if (skipInfo)
     skipInfo->resetOutput();
 
   if (isTextOrSVGChild())
     return parent();
 
   EPosition pos = m_style->position();
   if (pos == FixedPosition)
     return containerForFixedPosition(skipInfo);
 
-  if (pos == AbsolutePosition) {
+  if (pos == AbsolutePosition)
     return containerForAbsolutePosition(skipInfo);
-  }
 
   if (isColumnSpanAll()) {
     LayoutObject* multicolContainer = spannerPlaceholder()->container();
     if (skipInfo) {
       // We jumped directly from the spanner to the multicol container. Need to
       // check if we skipped |ancestor| or filter/reflection on the way.
       for (LayoutObject* walker = parent();
            walker && walker != multicolContainer; walker = walker->parent())
         skipInfo->update(*walker);
     }
     return multicolContainer;
   }
 
-  if (isFloating())
-    return containingBlock(skipInfo);
+  if (isFloating()) {
+    for (LayoutObject* object = parent(); object; object = object->parent()) {
+      if (object->canContainFloatingObject(*this))
+        return object;
+      if (skipInfo)
+        skipInfo->update(*object);
+    }
+  }

[chrishtr, 2017/01/21 02:14:59]

ASSERT_NOT_REACHED()

 
   return parent();
 }
 
 inline LayoutObject* LayoutObject::paintInvalidationParent() const {
   if (isLayoutView())
     return LayoutAPIShim::layoutObjectFrom(frame()->ownerLayoutItem());
   return parent();
 }
 
@@ skipping 978 matching lines @@
     const blink::LayoutObject* root = object1;
     while (root->parent())
       root = root->parent();
     root->showLayoutTreeAndMark(object1, "*", object2, "-", 0);
   } else {
     WTFLogAlways("%s", "Cannot showLayoutTree. Root is (nil)");
   }
 }
 
 #endif