Fix #641162: LayoutInline propagate position changes to abspos descendants

third_party/WebKit/Source/core/layout/LayoutInline.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 177 matching lines @@
         hasSelfPaintingLayer() || hasBoxDecorationBackground() ||
         newStyle.hasPadding() || newStyle.hasMargin() || newStyle.hasOutline();
     if (oldStyle && alwaysCreateLineBoxesNew) {
       dirtyLineBoxes(false);
       setNeedsLayoutAndFullPaintInvalidation(
           LayoutInvalidationReason::StyleChange);
     }
     setAlwaysCreateLineBoxes(alwaysCreateLineBoxesNew);
   }
 
+  // If we are changing to/from static, we need to reposition
+  // out-of-flow positioned descendants.
+  if (oldStyle && oldStyle->position() != newStyle.position() &&
+      (newStyle.position() == StaticPosition ||
+       oldStyle->position() == StaticPosition)) {
+    LayoutBlock* absContainingBlock = nullptr;
+    if (oldStyle->position() == StaticPosition) {
+      absContainingBlock = containingBlockForAbsolutePosition();
+    } else {
+      // When position was not static, containingBlockForAbsolutePosition
+      // for our children is our existing containingBlock.
+      absContainingBlock = containingBlock();
+    }
+    if (absContainingBlock)
+      absContainingBlock->removePositionedObjects(this, NewContainingBlock);
+  }
+
   propagateStyleToAnonymousChildren();
 }
 
 static inline bool fontDifferenceRequiresLineBox(
     const ComputedStyle& style,
     const ComputedStyle& parentStyle) {
   const SimpleFontData* font = style.font().primaryFont();
   const SimpleFontData* parentFont = parentStyle.font().primaryFont();
 
   return (font && parentFont &&
@@ skipping 1294 matching lines @@
     paintInvalidator.invalidateDisplayItemClient(*box, invalidationReason);
 }
 
 // TODO(lunalu): Not to just dump 0, 0 as the x and y here
 LayoutRect LayoutInline::debugRect() const {
   IntRect linesBox = enclosingIntRect(linesBoundingBox());
   return LayoutRect(IntRect(0, 0, linesBox.width(), linesBox.height()));
 }
 
 }  // namespace blink