Fix shouldPaint issue when a composited floating iframe becomes non-self-painting

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 3980 matching lines @@
   if (isLayoutView()) {
     ScrollOffset offset = toLayoutView(this)->frameView()->getScrollOffset();
     adjustedLocation.move(LayoutSize(offset));
   }
 
   const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
   FloatingObjectSetIterator begin = floatingObjectSet.begin();
   for (FloatingObjectSetIterator it = floatingObjectSet.end(); it != begin;) {
     --it;
     const FloatingObject& floatingObject = *it->get();
-    if (floatingObject.shouldPaint()) {
+    if (floatingObject.shouldPaint() &&
+        // TODO(wangxianzhu): Should this be a DCHECK?
+        !floatingObject.layoutObject()->hasSelfPaintingLayer()) {
       LayoutUnit xOffset = xPositionForFloatIncludingMargin(floatingObject) -
                            floatingObject.layoutObject()->location().x();
       LayoutUnit yOffset = yPositionForFloatIncludingMargin(floatingObject) -
                            floatingObject.layoutObject()->location().y();
       LayoutPoint childPoint = flipFloatForWritingModeForChild(
           floatingObject, adjustedLocation + LayoutSize(xOffset, yOffset));
       if (floatingObject.layoutObject()->hitTest(result, locationInContainer,
                                                  childPoint)) {
         updateHitTestResult(
             result, locationInContainer.point() - toLayoutSize(childPoint));
@@ skipping 32 matching lines @@
     LayoutUnit logicalTop,
     LayoutUnit fixedOffset,
     LayoutUnit logicalHeight) const {
   if (m_floatingObjects && m_floatingObjects->hasRightObjects())
     return m_floatingObjects->logicalRightOffset(fixedOffset, logicalTop,
                                                  logicalHeight);
 
   return fixedOffset;
 }
 
-void LayoutBlockFlow::setAncestorShouldPaintFloatingObject(
+void LayoutBlockFlow::updateAncestorShouldPaintFloatingObject(
     const LayoutBox& floatBox) {
   ASSERT(floatBox.isFloating());
   bool floatBoxIsSelfPaintingLayer =
       floatBox.hasLayer() && floatBox.layer()->isSelfPaintingLayer();
   for (LayoutObject* ancestor = floatBox.parent();
        ancestor && ancestor->isLayoutBlockFlow();
        ancestor = ancestor->parent()) {
     LayoutBlockFlow* ancestorBlock = toLayoutBlockFlow(ancestor);
     FloatingObjects* ancestorFloatingObjects =
         ancestorBlock->m_floatingObjects.get();
@@ skipping 533 matching lines @@
   return LayoutBlock::invalidatePaintIfNeeded(paintInvalidationState);
 }
 
 void LayoutBlockFlow::invalidateDisplayItemClients(
     PaintInvalidationReason invalidationReason) const {
   BlockFlowPaintInvalidator(*this).invalidateDisplayItemClients(
       invalidationReason);
 }
 
 }  // namespace blink