Don't change the height of a layout object while not laying it out.

Source/core/layout/LayoutDeprecatedFlexibleBox.cpp

 /*
  * This file is part of the layout object implementation for KHTML.
  *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 382 matching lines @@
 
             if (child->style()->visibility() == COLLAPSE) {
                 // visibility: collapsed children do not participate in our positioning.
                 // But we need to lay them down.
                 child->layoutIfNeeded();
                 continue;
             }
 
             SubtreeLayoutScope layoutScope(*child);
 
-            // We need to see if this child's height has changed, since we make block elements
-            // fill the height of a containing box by default.
-            // Now do a layout.
-            LayoutUnit oldChildHeight = child->size().height();
-            child->updateLogicalHeight();
-            if (oldChildHeight != child->size().height())
+            // We need to see if this child's height will change, since we make block elements fill
+            // the height of a containing box by default. We cannot actually *set* the new height
+            // here, though. Need to do that from within layout, or we won't be able to detect the
+            // change and duly notify any positioned descendants that are affected by it.
+            LayoutUnit oldChildHeight = child->logicalHeight();
+            LogicalExtentComputedValues computedValues;
+            child->computeLogicalHeight(child->logicalHeight(), child->logicalTop(), computedValues);
+            LayoutUnit newChildHeight = computedValues.m_extent;
+            if (oldChildHeight != newChildHeight)
                 layoutScope.setChildNeedsLayout(child);
 
             if (!child->needsLayout())
                 child->markForPaginationRelayoutIfNeeded(layoutScope);
 
             child->layoutIfNeeded();
 
             // We can place the child now, using our value of box-align.
             xPos += child->marginLeft();
             LayoutUnit childY = yPos;
@@ skipping 583 matching lines @@
     if (minHeight.isFixed() || minHeight.isAuto()) {
         LayoutUnit minHeight = child->style()->minHeight().value();
         LayoutUnit height = contentHeightForChild(child);
         LayoutUnit allowedShrinkage = std::min<LayoutUnit>(0, minHeight - height);
         return allowedShrinkage;
     }
     return 0;
 }
 
 } // namespace blink