Fix position of floating layer whose containing block is also floating

third_party/WebKit/Source/core/paint/PaintLayer.cpp

Index: third_party/WebKit/Source/core/paint/PaintLayer.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintLayer.cpp b/third_party/WebKit/Source/core/paint/PaintLayer.cpp
index abd609c8f6e5c374e79065e6f3e944837b4054fa..0fa096a60ab977b08d8db58791e7687908a9c4da 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayer.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayer.cpp
@@ -869,24 +869,28 @@ PaintLayer* PaintLayer::containingLayer(const PaintLayer* ancestor,
   if (skippedAncestor)
     *skippedAncestor = false;
 
-  LayoutObject& layoutObject = this->layoutObject();
-  if (layoutObject.isColumnSpanAll() ||
-      layoutObject.isFloatingWithNonContainingBlockParent()) {

[chrishtr, 2017/03/21 21:48:46]

Do the other callsites of isFloatingWithNonContainingBlockParent() need some
adjustment?
Do we invalidate correctly for nested floats?

[Xianzhu, 2017/03/22 15:03:15]

The function is still good for checking if a floating object's enclosing layer
is in the containing block chain.

Patch Set 2 is a more general approach fixing the more general bug
(crbug.com/703481). Actually whether the layer itself is floating is not the
key. The problem is that there might be non-layer floating object ancestor
changing the containing layer order of a layer.

When the parent layer is an inline, we should traverse the containing block
chain to find the containing layer to ensure correctness if there is any
floating object. We don't need to know if there is any floating object because
the traversal is actually a universal slow path suitable for any layer to find
the containing layer.
Invalidation is good. containingLayer affects painting only.

+  LayoutObject* layoutObject = &this->layoutObject();
+  if (layoutObject->isColumnSpanAll() || layoutObject->isFloating()) {
     Optional<LayoutObject::AncestorSkipInfo> skipInfo;
     if (skippedAncestor)
       skipInfo.emplace(&ancestor->layoutObject());
-    if (auto containingBlock = layoutObject.containingBlock(
-            skippedAncestor ? &*skipInfo : nullptr)) {
+    while (auto containingBlock = layoutObject->containingBlock(
+               skippedAncestor ? &*skipInfo : nullptr)) {
       if (skippedAncestor && skipInfo->ancestorSkipped())
         *skippedAncestor = true;
+      if (layoutObject->isFloating() && containingBlock->isFloating() &&
+          !containingBlock->hasLayer()) {
+        layoutObject = containingBlock;
+        continue;
+      }
       return containingBlock->enclosingLayer();
     }
     return nullptr;
   }
 
-  if (layoutObject.isOutOfFlowPositioned()) {
+  if (layoutObject->isOutOfFlowPositioned()) {
     auto canContainThisLayer =
-        layoutObject.isFixedPositioned()
+        layoutObject->isFixedPositioned()
             ? &LayoutObject::canContainFixedPositionObjects
             : &LayoutObject::canContainAbsolutePositionObjects;