Don't change the height of a layout object while not laying it out.

Source/core/layout/LayoutDeprecatedFlexibleBox.cpp

Index: Source/core/layout/LayoutDeprecatedFlexibleBox.cpp
diff --git a/Source/core/layout/LayoutDeprecatedFlexibleBox.cpp b/Source/core/layout/LayoutDeprecatedFlexibleBox.cpp
index 4761a008c0ab2ddf0ef670f19b5d0402fa7faf49..840c0d0831d0f5f4e117de7c550447bf7ff4917b 100644
--- a/Source/core/layout/LayoutDeprecatedFlexibleBox.cpp
+++ b/Source/core/layout/LayoutDeprecatedFlexibleBox.cpp
@@ -400,12 +400,15 @@ void LayoutDeprecatedFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
 
             SubtreeLayoutScope layoutScope(*child);
 
-            // We need to see if this child's height has changed, since we make block elements
-            // fill the height of a containing box by default.
-            // Now do a layout.
-            LayoutUnit oldChildHeight = child->size().height();
-            child->updateLogicalHeight();
-            if (oldChildHeight != child->size().height())
+            // We need to see if this child's height will change, since we make block elements fill
+            // the height of a containing box by default. We cannot actually *set* the new height
+            // here, though. Need to do that from within layout, or we won't be able to detect the
+            // change and duly notify any positioned descendants that are affected by it.
+            LayoutUnit oldChildHeight = child->logicalHeight();
+            LogicalExtentComputedValues computedValues;
+            child->computeLogicalHeight(child->logicalHeight(), child->logicalTop(), computedValues);
+            LayoutUnit newChildHeight = computedValues.m_extent;
+            if (oldChildHeight != newChildHeight)
                 layoutScope.setChildNeedsLayout(child);
 
             if (!child->needsLayout())