Flowthread should move its floatlists to container when evacuating

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 3113 matching lines @@
     // If the child we're removing means that we can now treat all children as
     // inline without the need for anonymous blocks, then do that.
     MakeChildrenInlineIfPossible();
   }
 }
 
 void LayoutBlockFlow::MoveAllChildrenIncludingFloatsTo(
     LayoutBlock* to_block,
     bool full_remove_insert) {
   LayoutBlockFlow* to_block_flow = ToLayoutBlockFlow(to_block);
-  MoveAllChildrenTo(to_block_flow, full_remove_insert);
 
   // When a portion of the layout tree is being detached, anonymous blocks
   // will be combined as their children are deleted. In this process, the
   // anonymous block later in the tree is merged into the one preceding it.
   // It can happen that the later block (this) contains floats that the
   // previous block (toBlockFlow) did not contain, and thus are not in the
   // floating objects list for toBlockFlow. This can result in toBlockFlow
   // containing floats that are not in it's floating objects list, but are in
   // the floating objects lists of siblings and parents. This can cause problems
   // when the float itself is deleted, since the deletion code assumes that if a
@@ skipping 17 matching lines @@
          it != end; ++it) {
       const FloatingObject& floating_object = *it->get();
 
       // Don't insert the object again if it's already in the list
       if (to_block_flow->ContainsFloat(floating_object.GetLayoutObject()))
         continue;
 
       to_block_flow->floating_objects_->Add(floating_object.UnsafeClone());
     }
   }
+  MoveAllChildrenTo(to_block_flow, full_remove_insert);

[rhogan, 2017/05/05 19:04:07]

If full_remove_insert is true, the object's floatlist gets cleared so copying
the floats after the fact will be a null op!

 }
 
 void LayoutBlockFlow::ChildBecameFloatingOrOutOfFlow(LayoutBox* child) {
   MakeChildrenInlineIfPossible();
 
   // Reparent the child to an adjacent anonymous block if one is available.
   LayoutObject* prev = child->PreviousSibling();
   if (prev && prev->IsAnonymousBlock() && prev->IsLayoutBlockFlow()) {
     LayoutBlockFlow* new_container = ToLayoutBlockFlow(prev);
     MoveChildTo(new_container, child, nullptr, false);
@@ skipping 1487 matching lines @@
   return LayoutBlock::DeprecatedInvalidatePaint(paint_invalidation_state);
 }
 
 void LayoutBlockFlow::InvalidateDisplayItemClients(
     PaintInvalidationReason invalidation_reason) const {
   BlockFlowPaintInvalidator(*this).InvalidateDisplayItemClients(
       invalidation_reason);
 }
 
 }  // namespace blink