Fix wrong paint invalidation container for column spanners

third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/PaintInvalidationState.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutInline.h"
@@ skipping 115 matching lines @@
       m_paintInvalidationContainerForStackedContents =
           toLayoutBoxModelObject(&currentObject);
   } else if (currentObject.isLayoutView()) {
     // m_paintInvalidationContainerForStackedContents is only for stacked
     // descendants in its own frame, because it doesn't establish stacking
     // context for stacked contents in sub-frames. Contents stacked in the root
     // stacking context in this frame should use this frame's
     // paintInvalidationContainer.
     m_paintInvalidationContainerForStackedContents =
         m_paintInvalidationContainer;
-  } else if (currentObject.isFloatingWithNonContainingBlockParent()) {
+  } else if (currentObject.isFloatingWithNonContainingBlockParent() ||
+             currentObject.isColumnSpanAll()) {
+    // In these cases, the object may belong to an ancestor of the current
+    // paint invalidation container, in paint order.
     m_paintInvalidationContainer =
         &currentObject.containerForPaintInvalidation();
     m_cachedOffsetsEnabled = false;
   } else if (currentObject.styleRef().isStacked() &&
              // This is to exclude some objects (e.g. LayoutText) inheriting
              // stacked style from parent but aren't actually stacked.
              currentObject.hasLayer() &&
              m_paintInvalidationContainer !=
                  m_paintInvalidationContainerForStackedContents) {
     // The current object is stacked, so we should use
@@ skipping 483 matching lines @@
 }
 
 void PaintInvalidatorContextAdapter::mapLocalRectToPaintInvalidationBacking(
     const LayoutObject& object,
     LayoutRect& rect) const {
   DCHECK(&object == &m_paintInvalidationState.currentObject());
   m_paintInvalidationState.mapLocalRectToPaintInvalidationBacking(rect);
 }
 
 }  // namespace blink