Fix paint and rect mapping issues for stacked float under stacked inline

third_party/WebKit/Source/core/layout/VisualRectMappingTest.cpp

Index: third_party/WebKit/Source/core/layout/VisualRectMappingTest.cpp
diff --git a/third_party/WebKit/Source/core/layout/VisualRectMappingTest.cpp b/third_party/WebKit/Source/core/layout/VisualRectMappingTest.cpp
index 0ff805205e4e663ff8374cd3d58dcc11c6488345..ff236bca6dfdd9b9c6b4649da473764ad0184449 100644
--- a/third_party/WebKit/Source/core/layout/VisualRectMappingTest.cpp
+++ b/third_party/WebKit/Source/core/layout/VisualRectMappingTest.cpp
@@ -700,4 +700,33 @@ TEST_F(VisualRectMappingTest, FloatUnderInline) {
   EXPECT_EQ(LayoutRect(-200, -100, 33, 44), rect);
 }
 
+TEST_F(VisualRectMappingTest, StackedFloatUnderStackedInline) {
+  setBodyInnerHTML(
+      "<div style='position: absolute; top: 55px; left: 66px'>"
+      "  <span id='span' style='position: relative; top: 100px; left: 200px'>"
+      "    <div id='target' style='float: left; position: relative; "
+      "        top: 11px; left: 22px; width: 33px; height: 44px'>"
+      "    </div>"
+      "  </span>"
+      "</div>");
+
+  LayoutBoxModelObject* span =
+      toLayoutBoxModelObject(getLayoutObjectByElementId("span"));
+  LayoutBox* target = toLayoutBox(getLayoutObjectByElementId("target"));
+
+  LayoutRect targetVisualRect = target->localVisualRect();
+  EXPECT_EQ(LayoutRect(0, 0, 33, 44), targetVisualRect);
+
+  LayoutRect rect = targetVisualRect;
+  EXPECT_TRUE(target->mapToVisualRectInAncestorSpace(&layoutView(), rect));
+  // Includes all offsets.
+  EXPECT_EQ(LayoutRect(288, 166, 33, 44), rect);
+  EXPECT_EQ(rect, target->visualRect());
+
+  rect = targetVisualRect;
+  EXPECT_TRUE(target->mapToVisualRectInAncestorSpace(span, rect));
+  // Includes offset of floating.
+  EXPECT_EQ(LayoutRect(22, 11, 33, 44), rect);
+}
+
 }  // namespace blink