ancestorOverflowLayer should not cross frame boundaries.

third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp

Index: third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
diff --git a/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp b/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
index 9eb113c271eb2b5925b3f1b47ab2827c34e0d924..07959d654996fb22c7e4813e9bc87e73075a3731 100644
--- a/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
+++ b/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
@@ -53,6 +53,8 @@ bool PrePaintTreeWalk::walk(FrameView& frameView,
   }
 
   PrePaintTreeWalkContext context(parentContext);
+  // ancestorOverflowLayer does not cross frame boundaries.

[pdr., 2017/01/19 03:34:03]

Nice find, I think you are correct.

Can we just set ancestorOverflowPaintLayer to nullptr here?

Also, does this mean we can remove the isRootLayer() check in
updateAuxiliaryObjectProperties?

[flackr, 2017/01/19 13:45:35]

Yes.
Ah sorry, I missed that we had this, we still need to keep this if we set
ancestorOverflowPaintLayer to nullptr here since the root layer doesn't have an
overflow clip but does need to be the ancestor overflow layer to its
descendants.

+  context.ancestorOverflowPaintLayer = frameView.layer();
   m_propertyTreeBuilder.updateProperties(frameView, context.treeBuilderContext);
   m_paintInvalidator.invalidatePaintIfNeeded(frameView,
                                              context.paintInvalidatorContext);