Add out-of-flow descendants of spanners to their containing blocks in time.

Source/core/layout/LayoutMultiColumnFlowThread.cpp

 /*
  * Copyright (C) 2012 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 549 matching lines @@
             }
         }
         previousSet->endFlow(logicalTopInFlowThread);
     }
     LayoutBox* nextColumnBox = placeholder->nextSiblingMultiColumnBox();
     if (nextColumnBox && nextColumnBox->isLayoutMultiColumnSet()) {
         LayoutMultiColumnSet* nextSet = toLayoutMultiColumnSet(nextColumnBox);
         m_lastSetWorkedOn = nextSet;
         nextSet->beginFlow(logicalTopInFlowThread);
     }
+
+    // We'll lay out of spanners after flow thread layout has finished (during layout of the spanner
+    // placeholders). There may be containing blocks for out-of-flow positioned descendants of the
+    // spanner in the flow thread, so that out-of-flow objects inside the spanner will be laid out
+    // as part of flow thread layout (even if the spanner itself won't). We need to add such
+    // out-of-flow positioned objects to their containing blocks now, or they'll never get laid
+    // out. Since it's non-trivial to determine if we need this, and where such out-of-flow objects
+    // might be, just go through the whole subtree.
+    for (LayoutObject* descendant = layoutObject->slowFirstChild(); descendant; descendant = descendant->nextInPreOrder()) {
+        if (descendant->isBox() && descendant->isOutOfFlowPositioned())
+            descendant->containingBlock()->insertPositionedObject(toLayoutBox(descendant));
+    }
+
     return adjustment;
 }
 
 // When processing layout objects to remove or when processing layout objects that have just been
 // inserted, certain types of objects should be skipped.
 static bool shouldSkipInsertedOrRemovedChild(LayoutMultiColumnFlowThread* flowThread, const LayoutObject& child)
 {
     if (child.isSVG() && !child.isSVGRoot()) {
         // Don't descend into SVG objects. What's in there is of no interest, and there might even
         // be a foreignObject there with column-span:all, which doesn't apply to us.
@@ skipping 260 matching lines @@
 }
 
 bool LayoutMultiColumnFlowThread::isPageLogicalHeightKnown() const
 {
     if (LayoutMultiColumnSet* columnSet = lastMultiColumnSet())
         return columnSet->pageLogicalHeight();
     return false;
 }
 
 }