Don't mark a positioned object for layout when we've just laid it out.

Source/core/layout/LayoutBlock.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 1663 matching lines @@
     Length marginLeft = child.style()->marginStartUsing(style());
     Length marginRight = child.style()->marginEndUsing(style());
     LayoutUnit margin = 0;
     if (marginLeft.isFixed())
         margin += marginLeft.value();
     if (marginRight.isFixed())
         margin += marginRight.value();
     return margin;
 }
 
+static bool needsLayoutDueToStaticPosition(LayoutObject* child)
+{
+    // When a non-positioned block element moves, it may have positioned children that are implicitly positioned relative to the
+    // non-positioned block. In block flow we can detect these when we layout the non-positioned block (by noticing the change
+    // in the immediate parent's logical top in |adjustPositionedBlock|). In line layout we always need to mark the positioned
+    // child for layout if its statically positioned in the direction in which the object lays out.
+    // crbug.com/490322(rhogan): We probably need to move the block layout case in here too, as marking a positioned object for
+    // layout while laying out an object's children invalidly assumes that our positionedObjects list is in DOM order and that
+    // we could never mark a positioned object for layout *after* we've laid it out in layoutPositionedObjects.
+    if (!child->parent()->childrenInline())
+        return false;
+    const ComputedStyle* style = child->style();
+    bool isHorizontal = style->isHorizontalWritingMode();
+    return style->isDisplayInlineType() ? style->hasStaticInlinePosition(isHorizontal) : style->hasStaticBlockPosition(isHorizontal);
+}
+
 void LayoutBlock::layoutPositionedObjects(bool relayoutChildren, PositionedLayoutBehavior info)
 {
     TrackedLayoutBoxListHashSet* positionedDescendants = positionedObjects();
     if (!positionedDescendants)
         return;
 
     if (hasColumns())
         view()->layoutState()->clearPaginationInformation(); // Positioned objects are not part of the column flow, so they don't paginate with the columns.
 
     for (auto* positionedObject : *positionedDescendants) {
         positionedObject->setMayNeedPaintInvalidation();
 
         SubtreeLayoutScope layoutScope(*positionedObject);
         // A fixed position element with an absolute positioned ancestor has no way of knowing if the latter has changed position. So
         // if this is a fixed position element, mark it for layout if it has an abspos ancestor and needs to move with that ancestor, i.e.
         // it has static position.
         markFixedPositionObjectForLayoutIfNeeded(positionedObject, layoutScope);
         if (info == LayoutOnlyFixedPositionedObjects) {
             positionedObject->layoutIfNeeded();
             continue;
         }
 
-        // When a non-positioned block element moves, it may have positioned children that are implicitly positioned relative to the
-        // non-positioned block.  Rather than trying to detect all of these movement cases, we just always lay out positioned
-        // objects that are positioned implicitly like this.  Such objects are rare, and so in typical DHTML menu usage (where everything is
-        // positioned explicitly) this should not incur a performance penalty.
-        if (relayoutChildren || (positionedObject->style()->hasStaticBlockPosition(isHorizontalWritingMode()) && positionedObject->parent() != this))
+        if (relayoutChildren || needsLayoutDueToStaticPosition(positionedObject))
             layoutScope.setChildNeedsLayout(positionedObject);
 
         // If relayoutChildren is set and the child has percentage padding or an embedded content box, we also need to invalidate the childs pref widths.
         if (relayoutChildren && positionedObject->needsPreferredWidthsRecalculation())
             positionedObject->setPreferredLogicalWidthsDirty(MarkOnlyThis);
 
         if (!positionedObject->needsLayout())
             positionedObject->markForPaginationRelayoutIfNeeded(layoutScope);
 
         // If we are paginated or in a line grid, go ahead and compute a vertical position for our object now.
@@ skipping 2200 matching lines @@
 void LayoutBlock::showLineTreeAndMark(const InlineBox* markedBox1, const char* markedLabel1, const InlineBox* markedBox2, const char* markedLabel2, const LayoutObject* obj) const
 {
     showLayoutObject();
     for (const RootInlineBox* root = firstRootBox(); root; root = root->nextRootBox())
         root->showLineTreeAndMark(markedBox1, markedLabel1, markedBox2, markedLabel2, obj, 1);
 }
 
 #endif
 
 } // namespace blink