RenderGrid needs to pop its LayoutState before relayout.

Source/core/rendering/RenderFlowThread.cpp

 /*
  * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above
  *    copyright notice, this list of conditions and the following
  *    disclaimer.
@@ skipping 291 matching lines @@
 {
     if (const RenderBox* currentBoxDescendant = currentStatePusherRenderBox()) {
         LayoutState* layoutState = currentBoxDescendant->view()->layoutState();
         if (layoutState && layoutState->isPaginated()) {
             ASSERT(layoutState->renderer() == currentBoxDescendant);
             LayoutSize offsetDelta = layoutState->layoutOffset() - layoutState->pageOffset();
             setOffsetFromLogicalTopOfFirstRegion(currentBoxDescendant, currentBoxDescendant->isHorizontalWritingMode() ? offsetDelta.height() : offsetDelta.width());
         }
     }
 
+    ASSERT(!m_statePusherObjectsStack.contains(&object));
     m_statePusherObjectsStack.add(&object);
 }
 
 void RenderFlowThread::popFlowThreadLayoutState()
 {
     m_statePusherObjectsStack.removeLast();
 
     if (const RenderBox* currentBoxDescendant = currentStatePusherRenderBox()) {
         LayoutState* layoutState = currentBoxDescendant->view()->layoutState();
         if (layoutState && layoutState->isPaginated())
@@ skipping 69 matching lines @@
 {
     if (!m_renderFlowThread)
         return;
     RenderView* view = m_renderFlowThread->view();
     ASSERT(view->flowThreadController()->currentRenderFlowThread() == m_renderFlowThread);
     view->flowThreadController()->setCurrentRenderFlowThread(m_previousRenderFlowThread);
 }
 
 
 } // namespace blink