Fix #641162: LayoutInline propagate position changes to abspos descendants

third_party/WebKit/Source/core/layout/LayoutInline.cpp

Index: third_party/WebKit/Source/core/layout/LayoutInline.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutInline.cpp b/third_party/WebKit/Source/core/layout/LayoutInline.cpp
index f0d26ce8184d05770bef6261fab5c7a48e7b3ced..1c173c48b6254174163a90d83fbe0907a8019dfe 100644
--- a/third_party/WebKit/Source/core/layout/LayoutInline.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutInline.cpp
@@ -195,6 +195,23 @@ void LayoutInline::styleDidChange(StyleDifference diff,
     setAlwaysCreateLineBoxes(alwaysCreateLineBoxesNew);
   }
 
+  // If we are changing to/from static, we need to reposition
+  // out-of-flow positioned descendants.
+  if (oldStyle && oldStyle->position() != newStyle.position() &&
+      (newStyle.position() == StaticPosition ||
+       oldStyle->position() == StaticPosition)) {
+    LayoutBlock* absContainingBlock = nullptr;
+    if (oldStyle->position() == StaticPosition) {
+      absContainingBlock = containingBlockForAbsolutePosition();
+    } else {
+      // When position was not static, containingBlockForAbsolutePosition
+      // for our children is our existing containingBlock.
+      absContainingBlock = containingBlock();
+    }
+    if (absContainingBlock)
+      absContainingBlock->removePositionedObjects(this, NewContainingBlock);
+  }
+
   propagateStyleToAnonymousChildren();
 }