Fix position of floating layer whose containing block is also floating

third_party/WebKit/Source/core/paint/PaintLayer.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights
  * reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
@@ skipping 851 matching lines @@
 }
 
 PaintLayer* PaintLayer::containingLayer(const PaintLayer* ancestor,
                                         bool* skippedAncestor) const {
   // If we have specified an ancestor, surely the caller needs to know whether
   // we skipped it.
   DCHECK(!ancestor || skippedAncestor);
   if (skippedAncestor)
     *skippedAncestor = false;
 
-  LayoutObject& layoutObject = this->layoutObject();
-  if (layoutObject.isColumnSpanAll() ||
-      layoutObject.isFloatingWithNonContainingBlockParent()) {

[chrishtr, 2017/03/21 21:48:46]

Do the other callsites of isFloatingWithNonContainingBlockParent() need some
adjustment?
Do we invalidate correctly for nested floats?

[Xianzhu, 2017/03/22 15:03:15]

The function is still good for checking if a floating object's enclosing layer
is in the containing block chain.

Patch Set 2 is a more general approach fixing the more general bug
(crbug.com/703481). Actually whether the layer itself is floating is not the
key. The problem is that there might be non-layer floating object ancestor
changing the containing layer order of a layer.

When the parent layer is an inline, we should traverse the containing block
chain to find the containing layer to ensure correctness if there is any
floating object. We don't need to know if there is any floating object because
the traversal is actually a universal slow path suitable for any layer to find
the containing layer.
Invalidation is good. containingLayer affects painting only.

+  LayoutObject* layoutObject = &this->layoutObject();
+  if (layoutObject->isColumnSpanAll() || layoutObject->isFloating()) {
     Optional<LayoutObject::AncestorSkipInfo> skipInfo;
     if (skippedAncestor)
       skipInfo.emplace(&ancestor->layoutObject());
-    if (auto containingBlock = layoutObject.containingBlock(
-            skippedAncestor ? &*skipInfo : nullptr)) {
+    while (auto containingBlock = layoutObject->containingBlock(
+               skippedAncestor ? &*skipInfo : nullptr)) {
       if (skippedAncestor && skipInfo->ancestorSkipped())
         *skippedAncestor = true;
+      if (layoutObject->isFloating() && containingBlock->isFloating() &&
+          !containingBlock->hasLayer()) {
+        layoutObject = containingBlock;
+        continue;
+      }
       return containingBlock->enclosingLayer();
     }
     return nullptr;
   }
 
-  if (layoutObject.isOutOfFlowPositioned()) {
+  if (layoutObject->isOutOfFlowPositioned()) {
     auto canContainThisLayer =
-        layoutObject.isFixedPositioned()
+        layoutObject->isFixedPositioned()
             ? &LayoutObject::canContainFixedPositionObjects
             : &LayoutObject::canContainAbsolutePositionObjects;
 
     PaintLayer* curr = parent();
     while (curr && !((&curr->layoutObject())->*canContainThisLayer)()) {
       if (skippedAncestor && curr == ancestor)
         *skippedAncestor = true;
       curr = curr->parent();
     }
     return curr;
@@ skipping 2322 matching lines @@
 }
 
 void showLayerTree(const blink::LayoutObject* layoutObject) {
   if (!layoutObject) {
     LOG(INFO) << "Cannot showLayerTree. Root is (nil)";
     return;
   }
   showLayerTree(layoutObject->enclosingLayer());
 }
 #endif