Avoid stack overflow triggered by out-of-band layout of flexbox child.

Source/core/layout/LayoutMultiColumnFlowThread.h

 /*
  * Copyright (C) 2012 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 162 matching lines @@
     LayoutSize flowThreadTranslationAtOffset(LayoutUnit) const;
 
     LayoutPoint visualPointToFlowThreadPoint(const LayoutPoint& visualPoint) const override;
 
     LayoutMultiColumnSet* columnSetAtBlockOffset(LayoutUnit) const final;
 
     void layoutColumns(bool relayoutChildren, SubtreeLayoutScope&);
 
     bool isInInitialLayoutPass() const { return !m_inBalancingPass; }
 
+    // Skip past a column spanner during flow thread layout. Spanners are not laid out inside the
+    // flow thread, since the flow thread is not in a spanner's containing block chain (since the
+    // containing block is the multicol container).
+    void skipColumnSpanner(LayoutBox*, LayoutUnit logicalTopInFlowThread);
+
     bool recalculateColumnHeights();
 
     void columnRuleStyleDidChange();
 
     // Remove the spanner placeholder and return true if the specified object is no longer a valid spanner.
     bool removeSpannerPlaceholderIfNoLongerValid(LayoutBox* spannerObjectInFlowThread);
 
     LayoutMultiColumnFlowThread* enclosingFlowThread() const;
     LayoutUnit blockOffsetInEnclosingFlowThread() const { ASSERT(enclosingFlowThread()); return m_blockOffsetInEnclosingFlowThread; }
 
@@ skipping 15 matching lines @@
 
 private:
     void calculateColumnCountAndWidth(LayoutUnit& width, unsigned& count) const;
     void createAndInsertMultiColumnSet(LayoutBox* insertBefore = nullptr);
     void createAndInsertSpannerPlaceholder(LayoutBox* spannerObjectInFlowThread, LayoutObject* insertedBeforeInFlowThread);
     void destroySpannerPlaceholder(LayoutMultiColumnSpannerPlaceholder*);
     virtual bool descendantIsValidColumnSpanner(LayoutObject* descendant) const;
 
     void addColumnSetToThread(LayoutMultiColumnSet*) override;
     void willBeRemovedFromTree() override;
-    void skipColumnSpanner(LayoutBox*, LayoutUnit logicalTopInFlowThread) override;
     void flowThreadDescendantWasInserted(LayoutObject*) final;
     void flowThreadDescendantWillBeRemoved(LayoutObject*) final;
     void flowThreadDescendantStyleWillChange(LayoutObject*, StyleDifference, const ComputedStyle& newStyle) override;
     void flowThreadDescendantStyleDidChange(LayoutObject*, StyleDifference, const ComputedStyle& oldStyle) override;
     void computePreferredLogicalWidths() override;
     void computeLogicalHeight(LayoutUnit logicalHeight, LayoutUnit logicalTop, LogicalExtentComputedValues&) const override;
     void updateLogicalWidth() override;
     void setPageBreak(LayoutUnit offset, LayoutUnit spaceShortage) override;
     void updateMinimumPageHeight(LayoutUnit offset, LayoutUnit minHeight) override;
     bool addForcedColumnBreak(LayoutUnit, LayoutObject* breakChild, bool isBefore, LayoutUnit* offsetBreakAdjustment = nullptr) override;
@@ skipping 16 matching lines @@
     bool m_isBeingEvacuated;
 };
 
 // Cannot use DEFINE_LAYOUT_OBJECT_TYPE_CASTS here, because isMultiColumnFlowThread() is defined in
 // LayoutFlowThread, not in LayoutObject.
 DEFINE_TYPE_CASTS(LayoutMultiColumnFlowThread, LayoutFlowThread, object, object->isLayoutMultiColumnFlowThread(), object.isLayoutMultiColumnFlowThread());
 
 } // namespace blink
 
 #endif // LayoutMultiColumnFlowThread_h