Fix paint and rect mapping issues for stacked float under stacked inline

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintPropertyTreeBuilder.h"
 
 #include "core/dom/DOMNodeIds.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
@@ skipping 802 matching lines @@
   if (object.paintProperties() && object.paintProperties()->scroll()) {
     context.current.transform = object.paintProperties()->scrollTranslation();
     context.current.scroll = object.paintProperties()->scroll();
     context.current.shouldFlattenInheritedTransform = false;
   }
 }
 
 void PaintPropertyTreeBuilder::updateOutOfFlowContext(
     const LayoutObject& object,
     PaintPropertyTreeBuilderContext& context) {
-  if (object.isLayoutBlock())
-    context.paintOffsetForFloat = context.current.paintOffset;
+  if (object.isLayoutBlock()) {
+    context.paintOffsetForNonStackedFloat = context.paintOffsetForStackedFloat =
+        context.current.paintOffset;
+  } else if (object.styleRef().isStacked()) {
+    context.paintOffsetForStackedFloat = context.current.paintOffset;
+  }
 
   if (object.canContainAbsolutePositionObjects()) {
     context.absolutePosition = context.current;
     context.containerForAbsolutePosition = &object;
   }
 
   if (object.isLayoutView()) {
     if (RuntimeEnabledFeatures::rootLayerScrollingEnabled()) {
       const auto* initialFixedTransform = context.fixedPosition.transform;
       const auto* initialFixedScroll = context.fixedPosition.scroll;
@@ skipping 43 matching lines @@
 }
 
 void PaintPropertyTreeBuilder::updateContextForBoxPosition(
     const LayoutObject& object,
     PaintPropertyTreeBuilderContext& context) {
   if (!object.isBoxModelObject())
     return;
 
   const LayoutBoxModelObject& boxModelObject = toLayoutBoxModelObject(object);
 
-  if (boxModelObject.isFloating())
-    context.current.paintOffset = context.paintOffsetForFloat;
+  if (boxModelObject.isFloating()) {
+    context.current.paintOffset = boxModelObject.styleRef().isStacked()
+                                      ? context.paintOffsetForStackedFloat
+                                      : context.paintOffsetForNonStackedFloat;
+  }
 
   // Multicolumn spanners are painted starting at the multicolumn container (but
   // still inherit properties in layout-tree order) so reset the paint offset.
   if (boxModelObject.isColumnSpanAll())
     context.current.paintOffset = boxModelObject.container()->paintOffset();
 
   switch (object.styleRef().position()) {
     case StaticPosition:
       break;
     case RelativePosition:
@@ skipping 89 matching lines @@
   updateOverflowClip(object, context);
   updatePerspective(object, context);
   updateSvgLocalToBorderBoxTransform(object, context);
   updateScrollAndScrollTranslation(object, context);
   updateOutOfFlowContext(object, context);
 
   context.forceSubtreeUpdate |= object.subtreeNeedsPaintPropertyUpdate();
 }
 
 }  // namespace blink