Update containing block's positioned descendants list when an object becomes out-of-flow-positioned

third_party/WebKit/Source/core/layout/LayoutBlock.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 184 matching lines @@
 
     const ComputedStyle& newStyle = styleRef();
 
     if (oldStyle && parent()) {
         if (oldStyle->position() != newStyle.position() && newStyle.position() != StaticPosition) {
             // In LayoutObject::styleWillChange() we already removed ourself from our old containing
             // block's positioned descendant list, and we will be inserted to the new containing
             // block's list during layout. However the positioned descendant layout logic assumes
             // layout objects to obey parent-child order in the list. Remove our descendants here
             // so they will be re-inserted after us.
-            if (LayoutBlock* cb = containingBlock())
+            if (LayoutBlock* cb = containingBlock()) {
                 cb->removePositionedObjects(this, NewContainingBlock);
+                if (isOutOfFlowPositioned()) {
+                    // Insert this object into containing block's positioned descendants list
+                    // in case the parent won't layout. This is needed especially there are
+                    // descendants scheduled for overflow recalc.
+                    cb->insertPositionedObject(this);
+                }
+            }
         }
     }
 
     if (TextAutosizer* textAutosizer = document().textAutosizer())
         textAutosizer->record(this);
 
     propagateStyleToAnonymousChildren();
 
     // It's possible for our border/padding to change, but for the overall logical width or height of the block to
     // end up being the same. We keep track of this change so in layoutBlock, we can know to set relayoutChildren=true.
@@ skipping 1635 matching lines @@
         for (TrackedLayoutBoxListHashSet::const_iterator it = positionedDescendantSet->begin(); it != end; ++it) {
             LayoutBox* currBox = *it;
             ASSERT(!currBox->needsLayout());
         }
     }
 }
 
 #endif
 
 } // namespace blink