Ensure that positioned objects' list is always in parent first order

Source/core/layout/LayoutBlock.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 257 matching lines @@
     LayoutBox::willBeDestroyed();
 }
 
 void LayoutBlock::styleWillChange(StyleDifference diff, const ComputedStyle& newStyle)
 {
     const ComputedStyle* oldStyle = style();
 
     setReplaced(newStyle.isDisplayInlineType());
 
     if (oldStyle && parent()) {
-        bool oldStyleIsContainer = oldStyle->position() != StaticPosition || oldStyle->hasTransformRelatedProperty();
-        bool newStyleIsContainer = newStyle.position() != StaticPosition || newStyle.hasTransformRelatedProperty();
+        bool oldHasTransformRelatedProperty = oldStyle->hasTransformRelatedProperty();
+        bool newHasTransformRelatedProperty = newStyle.hasTransformRelatedProperty();
+        bool oldStyleIsContainer = oldStyle->position() != StaticPosition || oldHasTransformRelatedProperty;
 
-        if (oldStyleIsContainer && !newStyleIsContainer) {
+        if (oldStyleIsContainer && (newStyle.position() == StaticPosition || (oldHasTransformRelatedProperty && !newHasTransformRelatedProperty))) {
             // Clear our positioned objects list. Our absolutely positioned descendants will be
             // inserted into our containing block's positioned objects list during layout.
             removePositionedObjects(0, NewContainingBlock);
-        } else if (!oldStyleIsContainer && newStyleIsContainer) {
+        } else if (!oldStyleIsContainer && (newStyle.position() != StaticPosition || newHasTransformRelatedProperty)) {
             // Remove our absolutely positioned descendants from their current containing block.
             // They will be inserted into our positioned objects list during layout.
-            LayoutObject* cb = parent();
-            while (cb && (cb->style()->position() == StaticPosition || (cb->isInline() && !cb->isReplaced())) && !cb->isLayoutView()) {
-                if (cb->style()->position() == RelativePosition && cb->isInline() && !cb->isReplaced()) {
-                    cb = cb->containingBlock();
-                    break;
-                }
-                cb = cb->parent();
-            }
-
-            if (cb->isLayoutBlock())
-                toLayoutBlock(cb)->removePositionedObjects(this, NewContainingBlock);
+            if (LayoutBlock* cb = containingBlock())
+                cb->removePositionedObjects(this, NewContainingBlock);
         }
     }
 
     LayoutBox::styleWillChange(diff, newStyle);
 }
 
 static bool borderOrPaddingLogicalWidthChanged(const ComputedStyle& oldStyle, const ComputedStyle& newStyle)
 {
     if (newStyle.isHorizontalWritingMode()) {
         return oldStyle.borderLeftWidth() != newStyle.borderLeftWidth()
@@ skipping 10 matching lines @@
 
 void LayoutBlock::styleDidChange(StyleDifference diff, const ComputedStyle* oldStyle)
 {
     LayoutBox::styleDidChange(diff, oldStyle);
 
     if (isFloatingOrOutOfFlowPositioned() && oldStyle && !oldStyle->isFloating() && !oldStyle->hasOutOfFlowPosition() && parent() && parent()->isLayoutBlockFlow())
         toLayoutBlock(parent())->removeAnonymousWrappersIfRequired();
 
     const ComputedStyle& newStyle = styleRef();
 
+    if (oldStyle && parent()) {
+        if (oldStyle->position() != newStyle.position() && newStyle.position() != StaticPosition) {
+            // Remove our absolutely positioned descendants from their new containing block,
+            // in case containingBlock() changes by the change to the position property.
+            // See styleWillChange() for other cases.
+            if (LayoutBlock* cb = containingBlock())
+                cb->removePositionedObjects(this, NewContainingBlock);
+        }
+    }
+
     if (TextAutosizer* textAutosizer = document().textAutosizer())
         textAutosizer->record(this);
 
     propagateStyleToAnonymousChildren(true);
 
     // It's possible for our border/padding to change, but for the overall logical width of the block to
     // end up being the same. We keep track of this change so in layoutBlock, we can know to set relayoutChildren=true.
     m_widthAvailableToChildrenChanged |= oldStyle && diff.needsFullLayout() && needsLayout() && borderOrPaddingLogicalWidthChanged(*oldStyle, newStyle);
 
     // If the style has unloaded images, want to notify the ResourceLoadPriorityOptimizer so that
@@ skipping 2576 matching lines @@
 void LayoutBlock::showLineTreeAndMark(const InlineBox* markedBox1, const char* markedLabel1, const InlineBox* markedBox2, const char* markedLabel2, const LayoutObject* obj) const
 {
     showLayoutObject();
     for (const RootInlineBox* root = firstRootBox(); root; root = root->nextRootBox())
         root->showLineTreeAndMark(markedBox1, markedLabel1, markedBox2, markedLabel2, obj, 1);
 }
 
 #endif
 
 } // namespace blink