[New Multicolumn] Only the nearest ancestral flow thread may serve as a containing flow thread.

Source/core/layout/LayoutObject.cpp

Index: Source/core/layout/LayoutObject.cpp
diff --git a/Source/core/layout/LayoutObject.cpp b/Source/core/layout/LayoutObject.cpp
index 42e24d180e37902637798d3b3d1ddc2e09387728..9a128f6d43921fcfd7c8eab6e88579ff29c25033 100644
--- a/Source/core/layout/LayoutObject.cpp
+++ b/Source/core/layout/LayoutObject.cpp
@@ -611,9 +611,19 @@ LayoutFlowThread* LayoutObject::locateFlowThreadContainingBlock() const
     while (curr) {
         if (curr->isLayoutFlowThread())
             return toLayoutFlowThread(curr);
-        curr = curr->containingBlock();
+        LayoutObject* containingBlock = curr->containingBlock();
+        curr = curr->parent();
+        while (curr != containingBlock) {
+            if (curr->isLayoutFlowThread()) {
+                // The nearest ancestor flow thread isn't in our containing block chain. Then we
+                // aren't really part of any flow thread, and we should stop looking. This happens
+                // when there are out-of-flow objects or column spanners.
+                return nullptr;
+            }
+            curr = curr->parent();
+        }
     }
-    return 0;
+    return nullptr;
 }
 
 // FIXME: This could be used when changing the size of a renderer without children to skip some invalidations.
@@ -2462,7 +2472,7 @@ void LayoutObject::insertedIntoTree()
     if (!isFloating() && parent()->childrenInline())
         parent()->dirtyLinesFromChangedChild(this);
 
-    if (LayoutFlowThread* flowThread = parent()->flowThreadContainingBlock())
+    if (LayoutFlowThread* flowThread = flowThreadContainingBlock())
         flowThread->flowThreadDescendantWasInserted(this);
 }