Fix paint and rect mapping issues for stacked float under stacked inline

third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp

Index: third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
index 0b176f6ac0a85e3ac2d03ac8c26e95ed4dd85595..7fe5350f62805b06a05f8281315c16331f2cffb8 100644
--- a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
@@ -820,8 +820,12 @@ void PaintPropertyTreeBuilder::updateScrollAndScrollTranslation(
 void PaintPropertyTreeBuilder::updateOutOfFlowContext(
     const LayoutObject& object,
     PaintPropertyTreeBuilderContext& context) {
-  if (object.isLayoutBlock())
-    context.paintOffsetForFloat = context.current.paintOffset;
+  if (object.isLayoutBlock()) {
+    context.paintOffsetForNonStackedFloat = context.paintOffsetForStackedFloat =
+        context.current.paintOffset;
+  } else if (object.styleRef().isStacked()) {
+    context.paintOffsetForStackedFloat = context.current.paintOffset;
+  }
 
   if (object.canContainAbsolutePositionObjects()) {
     context.absolutePosition = context.current;
@@ -885,8 +889,11 @@ void PaintPropertyTreeBuilder::updateContextForBoxPosition(
 
   const LayoutBoxModelObject& boxModelObject = toLayoutBoxModelObject(object);
 
-  if (boxModelObject.isFloating())
-    context.current.paintOffset = context.paintOffsetForFloat;
+  if (boxModelObject.isFloating()) {
+    context.current.paintOffset = boxModelObject.styleRef().isStacked()
+                                      ? context.paintOffsetForStackedFloat
+                                      : context.paintOffsetForNonStackedFloat;
+  }
 
   // Multicolumn spanners are painted starting at the multicolumn container (but
   // still inherit properties in layout-tree order) so reset the paint offset.