Fix shouldPaint issue when a composited floating iframe becomes non-self-painting

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 3980 matching lines @@
   if (isLayoutView()) {
     ScrollOffset offset = toLayoutView(this)->frameView()->getScrollOffset();
     adjustedLocation.move(LayoutSize(offset));
   }
 
   const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
   FloatingObjectSetIterator begin = floatingObjectSet.begin();
   for (FloatingObjectSetIterator it = floatingObjectSet.end(); it != begin;) {
     --it;
     const FloatingObject& floatingObject = *it->get();
-    if (floatingObject.shouldPaint()) {
+    if (floatingObject.shouldPaint() &&
+        !floatingObject.layoutObject()->hasSelfPaintingLayer()) {

[chrishtr, 2017/01/25 20:47:57]

Why do you need this?

[Xianzhu, 2017/01/25 21:03:25]

This is a part of the revert, which I didn't look very closely at.
This is like the revert in BlockFlowPainter.cpp.
Perhaps it should be a DCHECK.

Added a TODO here, like I did in BlockFlowPainter.cpp.

This CL needs to be merged into M56, so I would like to take the safe side.

       LayoutUnit xOffset = xPositionForFloatIncludingMargin(floatingObject) -
                            floatingObject.layoutObject()->location().x();
       LayoutUnit yOffset = yPositionForFloatIncludingMargin(floatingObject) -
                            floatingObject.layoutObject()->location().y();
       LayoutPoint childPoint = flipFloatForWritingModeForChild(
           floatingObject, adjustedLocation + LayoutSize(xOffset, yOffset));
       if (floatingObject.layoutObject()->hitTest(result, locationInContainer,
                                                  childPoint)) {
         updateHitTestResult(
             result, locationInContainer.point() - toLayoutSize(childPoint));
@@ skipping 586 matching lines @@
   return LayoutBlock::invalidatePaintIfNeeded(paintInvalidationState);
 }
 
 void LayoutBlockFlow::invalidateDisplayItemClients(
     PaintInvalidationReason invalidationReason) const {
   BlockFlowPaintInvalidator(*this).invalidateDisplayItemClients(
       invalidationReason);
 }
 
 }  // namespace blink