Ensure that positioned objects' list is always in parent first order

Source/core/rendering/RenderBlock.cpp

Index: Source/core/rendering/RenderBlock.cpp
diff --git a/Source/core/rendering/RenderBlock.cpp b/Source/core/rendering/RenderBlock.cpp
index 5f6519f77ca37901b568e9e161b136a5bb61ffc1..65e15be61572decfb500f3a02d6363863e501212 100644
--- a/Source/core/rendering/RenderBlock.cpp
+++ b/Source/core/rendering/RenderBlock.cpp
@@ -319,6 +319,11 @@ void RenderBlock::styleWillChange(StyleDifference diff, const RenderStyle& newSt
 
             if (cb->isRenderBlock())
                 toRenderBlock(cb)->removePositionedObjects(this, NewContainingBlock);
+        } else if (oldStyle->position() != newStyle.position()) {
+            for (RenderObject* curr = parent(); curr; curr = curr->parent()) {
+                if (curr->isRenderBlock())
+                    toRenderBlock(curr)->removePositionedObjects(this, NewContainingBlock);
+            }
         }
     }
 
@@ -1939,12 +1944,13 @@ void RenderBlock::insertIntoTrackedRendererMaps(RenderBox* descendant, TrackedDe
         descendantSet = new TrackedRendererListHashSet;
         descendantsMap->set(this, adoptPtr(descendantSet));
     }
-    bool added = descendantSet->add(descendant).isNewEntry;
-    if (!added) {
+
+    if (descendantSet->contains(descendant)) {
         ASSERT(containerMap->get(descendant));
         ASSERT(containerMap->get(descendant)->contains(this));
         return;
     }
+    descendantSet->add(descendant);
 
     HashSet<RenderBlock*>* containerSet = containerMap->get(descendant);
     if (!containerSet) {