Fix paint and rect mapping issues for stacked float under stacked inline

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/PaintInvalidationState.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 116 matching lines @@
           toLayoutBoxModelObject(&currentObject);
   } else if (currentObject.isLayoutView()) {
     // m_paintInvalidationContainerForStackedContents is only for stacked
     // descendants in its own frame, because it doesn't establish stacking
     // context for stacked contents in sub-frames. Contents stacked in the root
     // stacking context in this frame should use this frame's
     // paintInvalidationContainer.
     m_paintInvalidationContainerForStackedContents =
         m_paintInvalidationContainer;
   } else if (currentObject.isFloating() &&
-             !currentObject.parent()->isLayoutBlock()) {
-    // See LayoutObject::paintingLayer() for specialty of floating objects.
+             !currentObject.parent()->canContainFloatingObject(currentObject)) {
     m_paintInvalidationContainer =
         &currentObject.containerForPaintInvalidation();
     m_cachedOffsetsEnabled = false;
   } else if (currentObject.styleRef().isStacked() &&
              // This is to exclude some objects (e.g. LayoutText) inheriting
              // stacked style from parent but aren't actually stacked.
              currentObject.hasLayer() &&
              m_paintInvalidationContainer !=
                  m_paintInvalidationContainerForStackedContents) {
     // The current object is stacked, so we should use
@@ skipping 75 matching lines @@
   updateForCurrentObject(parentState);
 }
 
 PaintLayer& PaintInvalidationState::childPaintingLayer(
     const LayoutObject& child) const {
   if (child.hasLayer() && toLayoutBoxModelObject(child).hasSelfPaintingLayer())
     return *toLayoutBoxModelObject(child).layer();
   // See LayoutObject::paintingLayer() for the special-cases of floating under
   // inline and multicolumn.
   if (child.isColumnSpanAll() ||
-      (child.isFloating() && !m_currentObject.isLayoutBlock()))
+      (child.isFloating() && !child.parent()->canContainFloatingObject(child)))
     return *child.paintingLayer();
   return m_paintingLayer;
 }
 
 void PaintInvalidationState::updateForCurrentObject(
     const PaintInvalidationState& parentState) {
   if (!m_cachedOffsetsEnabled)
     return;
 
   if (m_currentObject.isLayoutView()) {
@@ skipping 387 matching lines @@
 }
 
 void PaintInvalidatorContextAdapter::mapLocalRectToPaintInvalidationBacking(
     const LayoutObject& object,
     LayoutRect& rect) const {
   DCHECK(&object == &m_paintInvalidationState.currentObject());
   m_paintInvalidationState.mapLocalRectToPaintInvalidationBacking(rect);
 }
 
 }  // namespace blink