Ensure that positioned objects' list is always in parent first order

Source/core/layout/LayoutObject.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 839 matching lines @@
             break;
         }
         o = container;
     }
 }
 
 LayoutBlock* LayoutObject::containerForFixedPosition(const LayoutBoxModelObject* paintInvalidationContainer, bool* paintInvalidationContainerSkipped) const
 {
     ASSERT(!paintInvalidationContainerSkipped || !*paintInvalidationContainerSkipped);
     ASSERT(!isText());
-    ASSERT(style()->position() == FixedPosition);
+    // Ideally we'd like to ASSERT here, but containingBlock(overrideStyle) can hit this
+    // when calculating containingBlock if the style was changed to overrideStyle.
+    // ASSERT(style()->position() == FixedPosition);
 
     LayoutObject* ancestor = parent();
     for (; ancestor && !ancestor->canContainFixedPositionObjects(); ancestor = ancestor->parent()) {
         if (paintInvalidationContainerSkipped && ancestor == paintInvalidationContainer)
             *paintInvalidationContainerSkipped = true;
     }
 
     ASSERT(!ancestor || !ancestor->isAnonymousBlock());
     return toLayoutBlock(ancestor);
 }
 
-LayoutBlock* LayoutObject::containingBlock() const
+LayoutBlock* LayoutObject::containingBlock(const ComputedStyle* overrideStyle) const
 {
     LayoutObject* o = parent();
     if (!o && isLayoutScrollbarPart())
         o = toLayoutScrollbarPart(this)->layoutObjectOwningScrollbar();
-    if (!isTextOrSVGChild() && m_style->position() == FixedPosition)
+    const ComputedStyle* style = overrideStyle ? overrideStyle : m_style.get();
+    if (!isTextOrSVGChild() && style->position() == FixedPosition)
         return containerForFixedPosition();
-    if (!isTextOrSVGChild() && m_style->position() == AbsolutePosition) {
+    if (!isTextOrSVGChild() && style->position() == AbsolutePosition) {
         while (o) {
             // For relpositioned inlines, we return the nearest non-anonymous enclosing block. We don't try
             // to return the inline itself.  This allows us to avoid having a positioned objects
             // list in all LayoutInlines and lets us return a strongly-typed LayoutBlock* result
             // from this method.  The container() method can actually be used to obtain the
             // inline directly.
             if (o->style()->position() != StaticPosition && (!o->isInline() || o->isReplaced()))
                 break;
 
             if (o->canContainFixedPositionObjects())
@@ skipping 2417 matching lines @@
         const blink::LayoutObject* root = object1;
         while (root->parent())
             root = root->parent();
         root->showLayoutTreeAndMark(object1, "*", object2, "-", 0);
     } else {
         fprintf(stderr, "Cannot showLayoutTree. Root is (nil)\n");
     }
 }
 
 #endif