Fix wrong paint invalidation container for column spanners

third_party/WebKit/Source/core/paint/PaintInvalidator.cpp

Index: third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp b/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
index 75c51d9bf4c2fbbdea10b937af03feb53010c2d5..54bb8dc00a85b2f0d1823554bdbaef2251a1dafa 100644
--- a/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintInvalidator.cpp
@@ -297,7 +297,10 @@ void PaintInvalidator::updatePaintInvalidationContainer(
     // this frame's paintInvalidationContainer.
     context.paintInvalidationContainerForStackedContents =
         context.paintInvalidationContainer;
-  } else if (object.isFloatingWithNonContainingBlockParent()) {
+  } else if (object.isFloatingWithNonContainingBlockParent() ||
+             object.isColumnSpanAll()) {
+    // In these cases, the object may belong to an ancestor of the current
+    // paint invalidation container, in paint order.
     context.paintInvalidationContainer =
         &object.containerForPaintInvalidation();
   } else if (object.styleRef().isStacked() &&