Be sure to skip objects inside out-of-flow subtrees.

Source/core/layout/LayoutMultiColumnFlowThread.cpp

 /*
  * Copyright (C) 2012 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 55 matching lines @@
 
 LayoutMultiColumnSet* LayoutMultiColumnFlowThread::lastMultiColumnSet() const
 {
     for (LayoutObject* sibling = multiColumnBlockFlow()->lastChild(); sibling; sibling = sibling->previousSibling()) {
         if (sibling->isLayoutMultiColumnSet())
             return toLayoutMultiColumnSet(sibling);
     }
     return nullptr;
 }
 
+// Find the next layout object that has the multicol container in its containing block chain.
 static LayoutObject* nextInPreOrderAfterChildrenSkippingOutOfFlow(LayoutMultiColumnFlowThread* flowThread, LayoutObject* descendant)
 {
     ASSERT(descendant->isDescendantOf(flowThread));
     LayoutObject* object = descendant->nextInPreOrderAfterChildren(flowThread);
     while (object) {
         // Walk through the siblings and find the first one which is either in-flow or has this
         // flow thread as its containing block flow thread.
         if (!object->isOutOfFlowPositioned())
             break;
         if (object->containingBlock()->flowThreadContainingBlock() == flowThread) {
             // This out-of-flow object is still part of the flow thread, because its containing
             // block (probably relatively positioned) is part of the flow thread.
             break;
         }
         object = object->nextInPreOrderAfterChildren(flowThread);
     }
     return object;
 }
 
+// Find the previous layout object that has the multicol container in its containing block chain.
 static LayoutObject* previousInPreOrderSkippingOutOfFlow(LayoutMultiColumnFlowThread* flowThread, LayoutObject* descendant)
 {
     ASSERT(descendant->isDescendantOf(flowThread));
     LayoutObject* object = descendant->previousInPreOrder(flowThread);
     while (object && object != flowThread) {
-        // Walk through the siblings and find the first one which is either in-flow or has this
-        // flow thread as its containing block flow thread.
-        if (!object->isOutOfFlowPositioned())
+        if (object->isColumnSpanAll() || object->flowThreadContainingBlock() == flowThread)
             break;
-        if (object->containingBlock()->flowThreadContainingBlock() == flowThread) {
-            // This out-of-flow object is still part of the flow thread, because its containing
-            // block (probably relatively positioned) is part of the flow thread.
-            break;
-        }
+        // We're inside something that's out-of-flow. Keep looking upwards and backwards in the tree.
         object = object->previousInPreOrder(flowThread);
     }
     return object && object != flowThread ? object : nullptr;
 }
 
 static LayoutObject* firstLayoutObjectInSet(LayoutMultiColumnSet* multicolSet)
 {
     LayoutBox* sibling = multicolSet->previousSiblingMultiColumnBox();
     if (!sibling)
         return multicolSet->flowThread()->firstChild();
@@ skipping 678 matching lines @@
 }
 
 bool LayoutMultiColumnFlowThread::isPageLogicalHeightKnown() const
 {
     if (LayoutMultiColumnSet* columnSet = lastMultiColumnSet())
         return columnSet->pageLogicalHeight();
     return false;
 }
 
 }