Fix paint and rect mapping issues for stacked float under stacked inline

third_party/WebKit/Source/core/layout/LayoutObject.h

Index: third_party/WebKit/Source/core/layout/LayoutObject.h
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.h b/third_party/WebKit/Source/core/layout/LayoutObject.h
index 785c2dfe6eb543fff71c48a62403d488505d505c..541f063c11ca96d284bc943525dbf6df1ac83439 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.h
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.h
@@ -953,8 +953,8 @@ class CORE_EXPORT LayoutObject : public ImageResourceObserver,
   //     and lets an enclosing block handle the layout of the positioned object.
   //     This does mean that computePositionedLogicalWidth and
   //     computePositionedLogicalHeight have to use container().
-  //
-  // Note that floating objects don't belong to either of the above exceptions.
+  // (3) For floating object, it returns the nearest ancestor whose
+  //     canContainFloatingObject(*this) is true.
   //
   // This function should be used for any invalidation as it would correctly
   // walk the containing block chain. See e.g. markContainerChainForLayout.
@@ -1165,6 +1165,15 @@ class CORE_EXPORT LayoutObject : public ImageResourceObserver,
            (isLayoutBlock() && m_style->canContainFixedPositionObjects());
   }
 
+  // A block can contain floating objects. A stacked inline can contain stacked
+  // floating objects. A floating object's container is the nearest ancestor
+  // that can contain the object.
+  bool canContainFloatingObject(const LayoutObject& floating) const {
+    DCHECK(floating.isFloating());
+    return isLayoutBlock() ||
+           (styleRef().isStacked() && floating.styleRef().isStacked());
+  }
+
   // Convert the given local point to absolute coordinates
   // FIXME: Temporary. If UseTransforms is true, take transforms into account.
   // Eventually localToAbsolute() will always be transform-aware.