Fix incorrectly painted right floats in LayoutNG

third_party/WebKit/Source/core/layout/ng/ng_block_layout_algorithm.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/ng/ng_block_layout_algorithm.h"
 
 #include "core/layout/ng/ng_absolute_utils.h"
 #include "core/layout/ng/ng_block_break_token.h"
 #include "core/layout/ng/ng_box_fragment.h"
 #include "core/layout/ng/ng_column_mapper.h"
@@ skipping 192 matching lines @@
 
   // Find a layout opportunity that will fit our float.
   const NGLayoutOpportunity opportunity =
       FindLayoutOpportunityForFragment(floating_object->space, float_fragment,
                                        origin_point, floating_object->margins);
   DCHECK(!opportunity.IsEmpty()) << "Opportunity is empty but it shouldn't be";
 
   // Calculate the float offset if needed.
   LayoutUnit float_offset;
   if (floating_object->exclusion_type == NGExclusion::kFloatRight) {
-    float_offset = opportunity.size.inline_size - float_fragment.InlineSize();
+    LayoutUnit float_margin_box_inline_size =
+        float_fragment.InlineSize() + floating_object->margins.InlineSum();
+    float_offset = opportunity.size.inline_size - float_margin_box_inline_size;
   }
 
   // Add the float as an exclusion.
   const NGExclusion exclusion = CreateExclusion(
       float_fragment, opportunity, float_offset, floating_object->margins,
       floating_object->exclusion_type);
   float_space->AddExclusion(exclusion);
 
   return CalculateLogicalOffsetForOpportunity(opportunity, float_offset,
                                               from_offset, floating_object);
 }
 
 // Updates the Floating Object's left offset from the provided parent_space
 // and {@code floating_object}'s space and margins.
 void UpdateFloatingObjectLeftOffset(
     const NGConstraintSpace& new_parent_space,
-    const Persistent<NGFloatingObject>& floating_object) {
-  const auto& float_space = floating_object->space;
+    const Persistent<NGFloatingObject>& floating_object,
+    const NGLogicalOffset& float_logical_offset) {
   // TODO(glebl): We should use physical offset here.
-  floating_object->left_offset = float_space->BfcOffset().inline_offset -
-                                 new_parent_space.BfcOffset().inline_offset +
-                                 floating_object->margins.inline_start;
+  floating_object->left_offset =
+      floating_object->original_parent_space->BfcOffset().inline_offset -
+      new_parent_space.BfcOffset().inline_offset +
+      float_logical_offset.inline_offset;
 }
 
 // Positions pending floats stored on the fragment builder starting from
 // {@code origin_point_block_offset}.
 void PositionPendingFloats(const LayoutUnit origin_point_block_offset,
                            const NGConstraintSpace& new_parent_space,
                            NGFragmentBuilder* builder) {
   DCHECK(builder->BfcOffset()) << "Parent BFC offset should be known here";
   LayoutUnit bfc_block_offset = builder->BfcOffset().value().block_offset;
 
   for (auto& floating_object : builder->UnpositionedFloats()) {
     Member<NGConstraintSpace> float_space = floating_object->space;
-    Member<const NGConstraintSpace> float_parent_space =
-        floating_object->parent_space;
+    Member<const NGConstraintSpace> original_parent_space =
+        floating_object->original_parent_space;
 
     NGLogicalOffset origin_point = {float_space->BfcOffset().inline_offset,
                                     origin_point_block_offset};
     NGLogicalOffset from_offset = {
-        float_parent_space->BfcOffset().inline_offset, bfc_block_offset};
+        original_parent_space->BfcOffset().inline_offset, bfc_block_offset};
 
     NGLogicalOffset float_fragment_offset =
         PositionFloat(origin_point, from_offset, floating_object);
     builder->AddFloatingObject(floating_object, float_fragment_offset);
-    UpdateFloatingObjectLeftOffset(new_parent_space, floating_object);
+    UpdateFloatingObjectLeftOffset(new_parent_space, floating_object,
+                                   float_fragment_offset);
   }
   builder->MutableUnpositionedFloats().clear();
 }
 
 // Whether an in-flow block-level child creates a new formatting context.
 //
 // This will *NOT* check the following cases:
 //  - The child is out-of-flow, e.g. floating or abs-pos.
 //  - The child is a inline-level, e.g. "display: inline-block".
 //  - The child establishes a new formatting context, but should be a child of
@@ skipping 560 matching lines @@
     space_builder_->SetMarginStrut(curr_margin_strut_);
   }
 
   space_builder_->SetBfcOffset(curr_bfc_offset_);
 
   return space_builder_->ToConstraintSpace(
       FromPlatformWritingMode(current_child_style.getWritingMode()));
 }
 
 }  // namespace blink