Fix position of floating layer whose containing block is also floating

third_party/WebKit/Source/core/paint/PaintLayer.cpp

Index: third_party/WebKit/Source/core/paint/PaintLayer.cpp
diff --git a/third_party/WebKit/Source/core/paint/PaintLayer.cpp b/third_party/WebKit/Source/core/paint/PaintLayer.cpp
index abd609c8f6e5c374e79065e6f3e944837b4054fa..4bf93cac73f42532baa478d26565475ecdfe23cc 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayer.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayer.cpp
@@ -870,8 +870,10 @@ PaintLayer* PaintLayer::containingLayer(const PaintLayer* ancestor,
     *skippedAncestor = false;
 
   LayoutObject& layoutObject = this->layoutObject();
-  if (layoutObject.isColumnSpanAll() ||
-      layoutObject.isFloatingWithNonContainingBlockParent()) {
+  // Column span need to find the containing layer through its containing block.
+  // TODO(wangxianzhu): This can be combined with the loop handing possible
+  // floating objects.
+  if (layoutObject.isColumnSpanAll()) {
     Optional<LayoutObject::AncestorSkipInfo> skipInfo;
     if (skippedAncestor)
       skipInfo.emplace(&ancestor->layoutObject());
@@ -899,7 +901,28 @@ PaintLayer* PaintLayer::containingLayer(const PaintLayer* ancestor,
     return curr;
   }
 
-  return parent();
+  // If the parent layer is not a block, there might be floating objects
+  // between this layer (included) and parent layer which need to escape the
+  // inline parent to find the actual containing layer through the containing
+  // block chain.
+  if (!parent() || parent()->layoutObject().isLayoutBlock())
+    return parent();
+
+  // This is a universal approach to find containing layer, but is slower than
+  // the earlier code.
+  Optional<LayoutObject::AncestorSkipInfo> skipInfo;
+  if (skippedAncestor)
+    skipInfo.emplace(&ancestor->layoutObject());
+  auto* object = &layoutObject;
+  while (auto* container =
+             object->container(skippedAncestor ? &*skipInfo : nullptr)) {
+    if (skippedAncestor && skipInfo->ancestorSkipped())
+      *skippedAncestor = true;
+    if (container->hasLayer())
+      return toLayoutBoxModelObject(container)->layer();
+    object = container;
+  }
+  return nullptr;
 }
 
 PaintLayer* PaintLayer::enclosingTransformedAncestor() const {