Add out-of-flow descendants of spanners to their containing blocks in time.

Source/core/layout/LayoutMultiColumnFlowThread.cpp

Index: Source/core/layout/LayoutMultiColumnFlowThread.cpp
diff --git a/Source/core/layout/LayoutMultiColumnFlowThread.cpp b/Source/core/layout/LayoutMultiColumnFlowThread.cpp
index d9929f020024998d91e7adcc88ee8be360e91edb..de8922526ca61d40729a23d21903d9ba71e31991 100644
--- a/Source/core/layout/LayoutMultiColumnFlowThread.cpp
+++ b/Source/core/layout/LayoutMultiColumnFlowThread.cpp
@@ -567,6 +567,19 @@ LayoutUnit LayoutMultiColumnFlowThread::skipColumnSpanner(LayoutBox* layoutObjec
         m_lastSetWorkedOn = nextSet;
         nextSet->beginFlow(logicalTopInFlowThread);
     }
+
+    // We'll lay out of spanners after flow thread layout has finished (during layout of the spanner
+    // placeholders). There may be containing blocks for out-of-flow positioned descendants of the
+    // spanner in the flow thread, so that out-of-flow objects inside the spanner will be laid out
+    // as part of flow thread layout (even if the spanner itself won't). We need to add such
+    // out-of-flow positioned objects to their containing blocks now, or they'll never get laid
+    // out. Since it's non-trivial to determine if we need this, and where such out-of-flow objects
+    // might be, just go through the whole subtree.
+    for (LayoutObject* descendant = layoutObject->slowFirstChild(); descendant; descendant = descendant->nextInPreOrder()) {
+        if (descendant->isBox() && descendant->isOutOfFlowPositioned())
+            descendant->containingBlock()->insertPositionedObject(toLayoutBox(descendant));
+    }
+
     return adjustment;
 }