[New Multicolumn] Don't enter child multicol contexts when processing object insertions / removals.

Source/core/layout/LayoutObject.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 249 matching lines @@
     return isHTMLHRElement(node());
 }
 
 bool LayoutObject::isLegend() const
 {
     return isHTMLLegendElement(node());
 }
 
 void LayoutObject::setFlowThreadStateIncludingDescendants(FlowThreadState state)
 {
-    for (LayoutObject *object = this; object; object = object->nextInPreOrder(this)) {
+    LayoutObject* next;
+    for (LayoutObject *object = this; object; object = next) {
         // If object is a fragmentation context it already updated the descendants flag accordingly.
-        if (object->isLayoutFlowThread())
+        if (object->isLayoutFlowThread()) {
+            next = object->nextInPreOrderAfterChildren(this);
             continue;
+        }
+        next = object->nextInPreOrder(this);
         ASSERT(state != object->flowThreadState());
         object->setFlowThreadState(state);
     }
 }
 
 bool LayoutObject::requiresAnonymousTableWrappers(const LayoutObject* newChild) const
 {
     // Check should agree with:
     // CSS 2.1 Tables: 17.2.1 Anonymous table objects
     // http://www.w3.org/TR/CSS21/tables.html#anonymous-boxes
@@ skipping 2204 matching lines @@
     // doesn't have the flow thread in its containing block chain. We still need to notify the flow
     // thread when the renderer removed happens to be a spanner, so that we get rid of the spanner
     // placeholder, and column sets around the placeholder get merged.
     LayoutFlowThread* flowThread = isColumnSpanAll() ? parent()->flowThreadContainingBlock() : flowThreadContainingBlock();
     removeFromLayoutFlowThreadRecursive(flowThread);
 }
 
 void LayoutObject::removeFromLayoutFlowThreadRecursive(LayoutFlowThread* renderFlowThread)
 {
     if (const LayoutObjectChildList* children = virtualChildren()) {
-        for (LayoutObject* child = children->firstChild(); child; child = child->nextSibling())
-            child->removeFromLayoutFlowThreadRecursive(renderFlowThread);
+        for (LayoutObject* child = children->firstChild(); child; child = child->nextSibling()) {
+            if (child->isLayoutFlowThread())
+                continue; // Don't descend into inner fragmentation contexts.
+            child->removeFromLayoutFlowThreadRecursive(child->isLayoutFlowThread() ? toLayoutFlowThread(child) : renderFlowThread);
+        }
     }
 
     if (renderFlowThread && renderFlowThread != this)
         renderFlowThread->flowThreadDescendantWillBeRemoved(this);
     setFlowThreadState(NotInsideFlowThread);
     RELEASE_ASSERT(!spannerPlaceholder());
 }
 
 void LayoutObject::destroyAndCleanupAnonymousWrappers()
 {
@@ skipping 746 matching lines @@
 {
     if (object1) {
         const blink::LayoutObject* root = object1;
         while (root->parent())
             root = root->parent();
         root->showLayoutTreeAndMark(object1, "*", object2, "-", 0);
     }
 }
 
 #endif