Fix wrong paint invalidation container for column spanners

third_party/WebKit/Source/core/paint/PaintInvalidator.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/PaintInvalidator.h"
 
 #include "core/editing/FrameSelection.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
@@ skipping 279 matching lines @@
       context.paintInvalidationContainerForStackedContents =
           toLayoutBoxModelObject(&object);
   } else if (object.isLayoutView()) {
     // paintInvalidationContainerForStackedContents is only for stacked
     // descendants in its own frame, because it doesn't establish stacking
     // context for stacked contents in sub-frames.
     // Contents stacked in the root stacking context in this frame should use
     // this frame's paintInvalidationContainer.
     context.paintInvalidationContainerForStackedContents =
         context.paintInvalidationContainer;
-  } else if (object.isFloatingWithNonContainingBlockParent()) {
+  } else if (object.isFloatingWithNonContainingBlockParent() ||
+             object.isColumnSpanAll()) {
+    // In these cases, the object may belong to an ancestor of the current
+    // paint invalidation container, in paint order.
     context.paintInvalidationContainer =
         &object.containerForPaintInvalidation();
   } else if (object.styleRef().isStacked() &&
              // This is to exclude some objects (e.g. LayoutText) inheriting
              // stacked style from parent but aren't actually stacked.
              object.hasLayer() &&
              context.paintInvalidationContainer !=
                  context.paintInvalidationContainerForStackedContents) {
     // The current object is stacked, so we should use
     // m_paintInvalidationContainerForStackedContents as its paint invalidation
@@ skipping 177 matching lines @@
   }
 }
 
 void PaintInvalidator::processPendingDelayedPaintInvalidations() {
   for (auto target : m_pendingDelayedPaintInvalidations)
     target->getMutableForPainting().setShouldDoFullPaintInvalidation(
         PaintInvalidationDelayedFull);
 }
 
 }  // namespace blink