Fix a regression when position:static with absolute child changed to relative

Source/core/layout/LayoutObject.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 847 matching lines @@
     LayoutObject* ancestor = parent();
     for (; ancestor && !ancestor->canContainFixedPositionObjects(); ancestor = ancestor->parent()) {
         if (paintInvalidationContainerSkipped && ancestor == paintInvalidationContainer)
             *paintInvalidationContainerSkipped = true;
     }
 
     ASSERT(!ancestor || !ancestor->isAnonymousBlock());
     return toLayoutBlock(ancestor);
 }
 
+LayoutBlock* LayoutObject::containerForAbsolutePosition() const
+{
+    LayoutObject* o = parent();
+    while (o) {
+        if (o->style()->position() != StaticPosition && (!o->isInline() || o->isReplaced()))
+            break;
+
+        if (o->canContainFixedPositionObjects())
+            break;
+
+        o = o->parent();
+    }
+
+    if (o && !o->isLayoutBlock())
+        o = o->containingBlock();
+
+    while (o && o->isAnonymousBlock())
+        o = o->containingBlock();
+
+    if (!o || !o->isLayoutBlock())
+        return nullptr; // This can still happen in case of an orphaned tree
+
+    return toLayoutBlock(o);
+}
+
 LayoutBlock* LayoutObject::containingBlock() const
 {
     LayoutObject* o = parent();
     if (!o && isLayoutScrollbarPart())
         o = toLayoutScrollbarPart(this)->layoutObjectOwningScrollbar();
     if (!isTextOrSVGChild() && m_style->position() == FixedPosition)
         return containerForFixedPosition();
-    if (!isTextOrSVGChild() && m_style->position() == AbsolutePosition) {
-        while (o) {
-            if (o->style()->position() != StaticPosition && (!o->isInline() || o->isReplaced()))
-                break;
-
-            if (o->canContainFixedPositionObjects())
-                break;
-
-            o = o->parent();
-        }
-
-        if (o && !o->isLayoutBlock())
-            o = o->containingBlock();
-
-        while (o && o->isAnonymousBlock())
-            o = o->containingBlock();
-    } else if (isColumnSpanAll()) {
+    if (!isTextOrSVGChild() && m_style->position() == AbsolutePosition)
+        return containerForAbsolutePosition();
+    if (isColumnSpanAll()) {
         o = spannerPlaceholder()->containingBlock();
     } else {
         while (o && ((o->isInline() && !o->isReplaced()) || !o->isLayoutBlock()))
             o = o->parent();
     }
 
     if (!o || !o->isLayoutBlock())
         return nullptr; // This can still happen in case of an orphaned tree
 
     return toLayoutBlock(o);
@@ skipping 2363 matching lines @@
         const blink::LayoutObject* root = object1;
         while (root->parent())
             root = root->parent();
         root->showLayoutTreeAndMark(object1, "*", object2, "-", 0);
     } else {
         fprintf(stderr, "Cannot showLayoutTree. Root is (nil)\n");
     }
 }
 
 #endif