Fix background-attachment:local <li> crash during PrePaintTreeWalk

third_party/WebKit/Source/core/paint/BoxPaintInvalidator.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/paint/BoxPaintInvalidator.h"
 
 #include "core/frame/Settings.h"
 #include "core/layout/LayoutView.h"
 #include "core/layout/compositing/CompositedLayerMapping.h"
 #include "core/paint/ObjectPaintInvalidator.h"
@@ skipping 199 matching lines @@
     should_fully_invalidate_on_scrolling_contents_layer = true;
   } else {
     // Check change of layout overflow for full or incremental invalidation.
     if (new_layout_overflow == old_layout_overflow)
       return;
     bool should_fully_invalidate =
         ShouldFullyInvalidateBackgroundOnLayoutOverflowChange(
             old_layout_overflow, new_layout_overflow);
     if (!paints_onto_scrolling_contents_layer) {
       if (should_fully_invalidate) {
-        box_.GetMutableForPainting().SetShouldDoFullPaintInvalidation(
-            kPaintInvalidationLayoutOverflowBoxChange);
+        box_.GetMutableForPainting()
+            .SetShouldDoFullPaintInvalidationWithoutGeometryChange(
+                kPaintInvalidationLayoutOverflowBoxChange);
       }
       return;
     }
     should_fully_invalidate_on_scrolling_contents_layer =
         should_fully_invalidate;
   }
 
   if (should_fully_invalidate_on_scrolling_contents_layer) {
     ObjectPaintInvalidatorWithContext(box_, context_)
         .FullyInvalidatePaint(
@@ skipping 87 matching lines @@
   if (NeedsToSavePreviousContentBoxSizeOrLayoutOverflowRect()) {
     box_.GetMutableForPainting()
         .SavePreviousContentBoxSizeAndLayoutOverflowRect();
   } else {
     box_.GetMutableForPainting()
         .ClearPreviousContentBoxSizeAndLayoutOverflowRect();
   }
 }
 
 }  // namespace blink