[New Multicolumn] Don't return the wrong flow thread from locateFlowThreadContainingBlock().

Source/core/layout/LayoutListItem.cpp

 /**
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Andrew Wellington (proton@wiretapped.net)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 254 matching lines @@
     return result;
 }
 
 void LayoutListItem::updateMarkerLocationAndInvalidateWidth()
 {
     ASSERT(m_marker);
 
     // FIXME: We should not modify the structure of the render tree
     // during layout. crbug.com/370461
     DeprecatedDisableModifyRenderTreeStructureAsserts disabler;
+    LayoutState* layoutState = view()->layoutState();
+    LayoutFlowThread* currentFlowThread = nullptr;
+    if (layoutState) {
+        // We're about to modify the layout tree structure (during layout!), and any code using
+        // LayoutState might get utterly confused by that. There's no evidence that anything other
+        // than the flow thread code will suffer, though, so just reset the current flow thread
+        // temporarily.
+        // FIXME: get rid of this hack, including the flow thread setter in LayoutState, as part of
+        // fixing crbug.com/370461
+        currentFlowThread = layoutState->flowThread();
+        layoutState->setFlowThread(nullptr);
+    }
     if (updateMarkerLocation()) {
         // If the marker is inside we need to redo the preferred width calculations
         // as the size of the item now includes the size of the list marker.
         if (m_marker->isInside())
             containingBlock()->updateLogicalWidth();
     }
+    if (layoutState)
+        layoutState->setFlowThread(currentFlowThread);
 }
 
 bool LayoutListItem::updateMarkerLocation()
 {
     ASSERT(m_marker);
     LayoutObject* markerParent = m_marker->parent();
     LayoutObject* lineBoxParent = getParentOfFirstLineBox(this, m_marker);
     if (!lineBoxParent) {
         // If the marker is currently contained inside an anonymous box, then we
         // are the only item in that anonymous box (since no line box parent was
@@ skipping 223 matching lines @@
             // assume that all the following ones have too.
             // This gives us the opportunity to stop here and avoid
             // marking the same nodes again.
             break;
         }
         item->updateValue();
     }
 }
 
 } // namespace blink