Fix paint and rect mapping issues for stacked float under stacked inline

third_party/WebKit/Source/core/layout/VisualRectMappingTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/LayoutTestHelper.h"
 #include "core/layout/LayoutView.h"
 #include "core/layout/PaintInvalidationState.h"
 #include "core/paint/PaintLayer.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ skipping 682 matching lines @@
   LayoutRect rect = targetVisualRect;
   EXPECT_TRUE(target->mapToVisualRectInAncestorSpace(&layoutView(), rect));
   EXPECT_EQ(LayoutRect(66, 55, 33, 44), rect);
   EXPECT_EQ(rect, target->visualRect());
 
   rect = targetVisualRect;
   EXPECT_TRUE(target->mapToVisualRectInAncestorSpace(span, rect));
   EXPECT_EQ(LayoutRect(-200, -100, 33, 44), rect);
 }
 
+TEST_F(VisualRectMappingTest, StackedFloatUnderStackedInline) {
+  setBodyInnerHTML(
+      "<div style='position: absolute; top: 55px; left: 66px'>"
+      "  <span id='span' style='position: relative; top: 100px; left: 200px'>"
+      "    <div id='target' style='float: left; position: relative; "
+      "        top: 11px; left: 22px; width: 33px; height: 44px'>"
+      "    </div>"
+      "  </span>"
+      "</div>");
+
+  LayoutBoxModelObject* span =
+      toLayoutBoxModelObject(getLayoutObjectByElementId("span"));
+  LayoutBox* target = toLayoutBox(getLayoutObjectByElementId("target"));
+
+  LayoutRect targetVisualRect = target->localVisualRect();
+  EXPECT_EQ(LayoutRect(0, 0, 33, 44), targetVisualRect);
+
+  LayoutRect rect = targetVisualRect;
+  EXPECT_TRUE(target->mapToVisualRectInAncestorSpace(&layoutView(), rect));
+  // Includes all offsets.
+  EXPECT_EQ(LayoutRect(288, 166, 33, 44), rect);
+  EXPECT_EQ(rect, target->visualRect());
+
+  rect = targetVisualRect;
+  EXPECT_TRUE(target->mapToVisualRectInAncestorSpace(span, rect));
+  // Includes offset of floating.
+  EXPECT_EQ(LayoutRect(22, 11, 33, 44), rect);
+}
+
 }  // namespace blink