Flowthread should move its floatlists to container when evacuating

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
index 540dbd3c8de5a9112a7b7c59384ef6b698f2e479..21c9b90bce98fba8b92a1d45131c527aaabb792d 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
@@ -3131,7 +3131,6 @@ void LayoutBlockFlow::MoveAllChildrenIncludingFloatsTo(
     LayoutBlock* to_block,
     bool full_remove_insert) {
   LayoutBlockFlow* to_block_flow = ToLayoutBlockFlow(to_block);
-  MoveAllChildrenTo(to_block_flow, full_remove_insert);
 
   // When a portion of the layout tree is being detached, anonymous blocks
   // will be combined as their children are deleted. In this process, the
@@ -3169,6 +3168,7 @@ void LayoutBlockFlow::MoveAllChildrenIncludingFloatsTo(
       to_block_flow->floating_objects_->Add(floating_object.UnsafeClone());
     }
   }
+  MoveAllChildrenTo(to_block_flow, full_remove_insert);

[rhogan, 2017/05/05 19:04:07]

If full_remove_insert is true, the object's floatlist gets cleared so copying
the floats after the fact will be a null op!

 }
 
 void LayoutBlockFlow::ChildBecameFloatingOrOutOfFlow(LayoutBox* child) {