Ensure that positioned objects' list is always in parent first order

Source/core/rendering/RenderBox.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  *           (C) 2005, 2006 Samuel Weinig (sam.weinig@gmail.com)
  * Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 146 matching lines @@
                     parentBlockFlow = currBlockFlow;
             }
         }
 
         if (parentBlockFlow) {
             parentBlockFlow->markSiblingsWithFloatsForLayout(this);
             parentBlockFlow->markAllDescendantsWithFloatsForLayout(this, false);
         }
     }
 
-    if (isOutOfFlowPositioned())
-        RenderBlock::removePositionedObject(this);
+    if (isOutOfFlowPositioned()) {
+        RenderBlock* block = const_cast<RenderBlock*>(toRenderBlock(this));
+        ASSERT(block);
+        for (RenderObject* curr = parent(); curr; curr = curr->parent()) {
+            ASSERT(curr);
+            if (curr->isRenderBlock()) {
+                // toRenderBlock(curr)->removePositionedObject(this);
+                toRenderBlock(curr)->removePositionedObjects(block, NewContainingBlock);
+            }
+        }
+    }
 }
 
 void RenderBox::styleWillChange(StyleDifference diff, const RenderStyle& newStyle)
 {
     RenderStyle* oldStyle = style();
     if (oldStyle) {
         // The background of the root element or the body element could propagate up to
         // the canvas. Just dirty the entire canvas when our style changes substantially.
         if ((diff.needsPaintInvalidation() || diff.needsLayout()) && node()
             && (isHTMLHtmlElement(*node()) || isHTMLBodyElement(*node()))) {
@@ skipping 4373 matching lines @@
     computedValues.m_margins.m_end = marginEnd();
 
     setLogicalTop(oldLogicalTop);
     setLogicalWidth(oldLogicalWidth);
     setLogicalLeft(oldLogicalLeft);
     setMarginLeft(oldMarginLeft);
     setMarginRight(oldMarginRight);
 }
 
 } // namespace blink