ancestorOverflowLayer should not cross frame boundaries.

third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PrePaintTreeWalk.h"
 
 #include "core/dom/DocumentLifecycle.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/layout/LayoutMultiColumnSpannerPlaceholder.h"
@@ skipping 35 matching lines @@
 
 bool PrePaintTreeWalk::walk(FrameView& frameView,
                             const PrePaintTreeWalkContext& parentContext) {
   if (frameView.shouldThrottleRendering()) {
     // The walk was interrupted by throttled rendering so this subtree was not
     // fully updated.
     return false;
   }
 
   PrePaintTreeWalkContext context(parentContext);
+  // ancestorOverflowLayer does not cross frame boundaries.
+  context.ancestorOverflowPaintLayer = nullptr;
   m_propertyTreeBuilder.updateProperties(frameView, context.treeBuilderContext);
   m_paintInvalidator.invalidatePaintIfNeeded(frameView,
                                              context.paintInvalidatorContext);
 
   LayoutView* view = frameView.layoutView();
   bool descendantsFullyUpdated = view ? walk(*view, context) : true;
   if (descendantsFullyUpdated) {
 #if DCHECK_IS_ON()
     frameView.layoutView()->assertSubtreeClearedPaintInvalidationFlags();
 #endif
@@ skipping 96 matching lines @@
 
   if (descendantsFullyUpdated) {
     // If descendants were not updated, do not clear flags. During the next
     // PrePaintTreeWalk, these flags will be used again.
     object.getMutableForPainting().clearPaintFlags();
   }
   return descendantsFullyUpdated;
 }
 
 }  // namespace blink