Fix paint and rect mapping issues for stacked float under stacked inline

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef PaintPropertyTreeBuilder_h
 #define PaintPropertyTreeBuilder_h
 
 #include "platform/geometry/LayoutPoint.h"
 #include "platform/graphics/paint/ClipPaintPropertyNode.h"
 #include "platform/graphics/paint/EffectPaintPropertyNode.h"
@@ skipping 47 matching lines @@
   // These additional contexts normally pass through untouched, and are only
   // copied from the main context when the current element serves as the
   // containing block of corresponding positioned descendants.  Overflow clips
   // are also inherited by containing block tree instead of DOM tree, thus they
   // are included in the additional context too.
   ContainingBlockContext absolutePosition;
   const LayoutObject* containerForAbsolutePosition = nullptr;
 
   ContainingBlockContext fixedPosition;
 
-  // This is the same as current.paintOffset except when a floating object has
-  // non-block ancestors under its containing block. Paint offsets of the
-  // non-block ancestors should not be accumulated for the floating object.
-  LayoutPoint paintOffsetForFloat;
+  // These are the same as current.paintOffset except when a floating object's
+  // parent is not a container. Paint offsets of the non-container ancestors
+  // should not be accumulated for the floating object.
+  LayoutPoint paintOffsetForNonStackedFloat;
+  LayoutPoint paintOffsetForStackedFloat;
 
   // The effect hierarchy is applied by the stacking context tree. It is
   // guaranteed that every DOM descendant is also a stacking context descendant.
   // Therefore, we don't need extra bookkeeping for effect nodes and can
   // generate the effect tree from a DOM-order traversal.
   const EffectPaintPropertyNode* currentEffect = nullptr;
   // Some effects are spatial, i.e. may refer to input pixels outside of output
   // clip. The cull rect for its input shall be derived from its output clip.
   // This variable represents the input cull of current effect, also serves as
   // output clip of child effects that don't have a hard clip.
@@ skipping 64 matching lines @@
       const LayoutObject&,
       PaintPropertyTreeBuilderContext&);
   ALWAYS_INLINE static void updateOutOfFlowContext(
       const LayoutObject&,
       PaintPropertyTreeBuilderContext&);
 };
 
 }  // namespace blink
 
 #endif  // PaintPropertyTreeBuilder_h