A new LayoutState should never locate a containing flow thread on its own.

third_party/WebKit/Source/core/layout/LayoutState.cpp

 /*
  * Copyright (C) 2007 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 77 matching lines @@
         m_isPaginated = false;
     } else {
         // If we don't establish a new page height, then propagate the old page height and offset down.
         m_pageLogicalHeight = m_next->m_pageLogicalHeight;
         m_pageLogicalHeightChanged = m_next->m_pageLogicalHeightChanged;
         m_pageOffset = m_next->m_pageOffset;
 
         // Disable pagination for objects we don't support. For now this includes overflow:scroll/auto, inline blocks and
         // writing mode roots.
         if (layoutObject.isUnsplittableForPagination()) {
+            m_flowThread = nullptr;
             m_pageLogicalHeight = 0;
             m_isPaginated = false;
         } else {
-            m_isPaginated = m_pageLogicalHeight || layoutObject.flowThreadContainingBlock();
+            m_isPaginated = m_pageLogicalHeight || m_flowThread;
         }
     }
 
     // FIXME: <http://bugs.webkit.org/show_bug.cgi?id=13443> Apply control clip if present.
 }
 
 LayoutState::LayoutState(LayoutObject& root)
     : m_isPaginated(false)
     , m_pageLogicalHeightChanged(false)
     , m_containingBlockLogicalWidthChanged(false)
@@ skipping 23 matching lines @@
 }
 
 LayoutUnit LayoutState::pageLogicalOffset(const LayoutBox& child, const LayoutUnit& childLogicalOffset) const
 {
     if (child.isHorizontalWritingMode())
         return m_layoutOffset.height() + childLogicalOffset - m_pageOffset.height();
     return m_layoutOffset.width() + childLogicalOffset - m_pageOffset.width();
 }
 
 } // namespace blink