Fix position of floating layer whose containing block is also floating

third_party/WebKit/Source/core/paint/PaintLayer.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights
  * reserved.
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
  * Other contributors:
  *   Robert O'Callahan <roc+@cs.cmu.edu>
  *   David Baron <dbaron@fas.harvard.edu>
  *   Christian Biesinger <cbiesinger@web.de>
@@ skipping 852 matching lines @@
 
 PaintLayer* PaintLayer::containingLayer(const PaintLayer* ancestor,
                                         bool* skippedAncestor) const {
   // If we have specified an ancestor, surely the caller needs to know whether
   // we skipped it.
   DCHECK(!ancestor || skippedAncestor);
   if (skippedAncestor)
     *skippedAncestor = false;
 
   LayoutObject& layoutObject = this->layoutObject();
-  if (layoutObject.isColumnSpanAll() ||
-      layoutObject.isFloatingWithNonContainingBlockParent()) {
+  // Column span need to find the containing layer through its containing block.
+  // TODO(wangxianzhu): This can be combined with the loop handing possible
+  // floating objects.
+  if (layoutObject.isColumnSpanAll()) {
     Optional<LayoutObject::AncestorSkipInfo> skipInfo;
     if (skippedAncestor)
       skipInfo.emplace(&ancestor->layoutObject());
     if (auto containingBlock = layoutObject.containingBlock(
             skippedAncestor ? &*skipInfo : nullptr)) {
       if (skippedAncestor && skipInfo->ancestorSkipped())
         *skippedAncestor = true;
       return containingBlock->enclosingLayer();
     }
     return nullptr;
   }
 
   if (layoutObject.isOutOfFlowPositioned()) {
     auto canContainThisLayer =
         layoutObject.isFixedPositioned()
             ? &LayoutObject::canContainFixedPositionObjects
             : &LayoutObject::canContainAbsolutePositionObjects;
 
     PaintLayer* curr = parent();
     while (curr && !((&curr->layoutObject())->*canContainThisLayer)()) {
       if (skippedAncestor && curr == ancestor)
         *skippedAncestor = true;
       curr = curr->parent();
     }
     return curr;
   }
 
-  return parent();
+  // If the parent layer is not a block, there might be floating objects
+  // between this layer (included) and parent layer which need to escape the
+  // inline parent to find the actual containing layer through the containing
+  // block chain.
+  if (!parent() || parent()->layoutObject().isLayoutBlock())
+    return parent();
+
+  // This is a universal approach to find containing layer, but is slower than
+  // the earlier code.
+  Optional<LayoutObject::AncestorSkipInfo> skipInfo;
+  if (skippedAncestor)
+    skipInfo.emplace(&ancestor->layoutObject());
+  auto* object = &layoutObject;
+  while (auto* container =
+             object->container(skippedAncestor ? &*skipInfo : nullptr)) {
+    if (skippedAncestor && skipInfo->ancestorSkipped())
+      *skippedAncestor = true;
+    if (container->hasLayer())
+      return toLayoutBoxModelObject(container)->layer();
+    object = container;
+  }
+  return nullptr;
 }
 
 PaintLayer* PaintLayer::enclosingTransformedAncestor() const {
   PaintLayer* curr = parent();
   while (curr && !curr->isRootLayer() && !curr->transform())
     curr = curr->parent();
 
   return curr;
 }
 
@@ skipping 2309 matching lines @@
 }
 
 void showLayerTree(const blink::LayoutObject* layoutObject) {
   if (!layoutObject) {
     LOG(INFO) << "Cannot showLayerTree. Root is (nil)";
     return;
   }
   showLayerTree(layoutObject->enclosingLayer());
 }
 #endif