Ensure that positioned objects' list is always in parent first order

Source/core/layout/LayoutObject.cpp

Index: Source/core/layout/LayoutObject.cpp
diff --git a/Source/core/layout/LayoutObject.cpp b/Source/core/layout/LayoutObject.cpp
index 9b76a8877e6b7d9990a3cbe82991cdb83e062057..124e2f699fdab7df99f7105047bfcdd691b0b4fe 100644
--- a/Source/core/layout/LayoutObject.cpp
+++ b/Source/core/layout/LayoutObject.cpp
@@ -857,7 +857,9 @@ LayoutBlock* LayoutObject::containerForFixedPosition(const LayoutBoxModelObject*
 {
     ASSERT(!paintInvalidationContainerSkipped || !*paintInvalidationContainerSkipped);
     ASSERT(!isText());
-    ASSERT(style()->position() == FixedPosition);
+    // Ideally we'd like to ASSERT here, but containingBlock(overrideStyle) can hit this
+    // when calculating containingBlock if the style was changed to overrideStyle.
+    // ASSERT(style()->position() == FixedPosition);
 
     LayoutObject* ancestor = parent();
     for (; ancestor && !ancestor->canContainFixedPositionObjects(); ancestor = ancestor->parent()) {
@@ -869,14 +871,15 @@ LayoutBlock* LayoutObject::containerForFixedPosition(const LayoutBoxModelObject*
     return toLayoutBlock(ancestor);
 }
 
-LayoutBlock* LayoutObject::containingBlock() const
+LayoutBlock* LayoutObject::containingBlock(const ComputedStyle* overrideStyle) const
 {
     LayoutObject* o = parent();
     if (!o && isLayoutScrollbarPart())
         o = toLayoutScrollbarPart(this)->layoutObjectOwningScrollbar();
-    if (!isTextOrSVGChild() && m_style->position() == FixedPosition)
+    const ComputedStyle* style = overrideStyle ? overrideStyle : m_style.get();
+    if (!isTextOrSVGChild() && style->position() == FixedPosition)
         return containerForFixedPosition();
-    if (!isTextOrSVGChild() && m_style->position() == AbsolutePosition) {
+    if (!isTextOrSVGChild() && style->position() == AbsolutePosition) {
         while (o) {
             // For relpositioned inlines, we return the nearest non-anonymous enclosing block. We don't try
             // to return the inline itself.  This allows us to avoid having a positioned objects