<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[168043] trunk/Source/WebCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/168043">168043</a></dd>
<dt>Author</dt> <dd>hyatt@apple.com</dd>
<dt>Date</dt> <dd>2014-04-30 14:27:50 -0700 (Wed, 30 Apr 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>[New Multicolumn] ASSERTs in fast/dynamic/continuation-detach-crash.html
https://bugs.webkit.org/show_bug.cgi?id=132392

Reviewed by Dean Jackson.

* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::setRegionRangeForBox):
Add ASSERTs in case we ever try to set regions from the wrong flow thread
as part of the box's region range.

* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):
Add a bunch of code that handles the discovery of a span from an outer flow thread
being inserted into an inner flow thread. This forces us to delete that placeholder
and shift the outer spanning content into the inner flow thread in order to get a new
mapping/placeholder created in the inner flow thread.

(WebCore::RenderMultiColumnFlowThread::flowThreadRelativeWillBeRemoved):
Tighten this code to use the parent() just in case we change the invariant of
parent = containingBlock later.

* rendering/RenderMultiColumnFlowThread.h:
Add a static guard when shifting a spanner to prevent the outer flow thread from
thinking the spanner belongs to it when it gets punted out of the inner flow thread.
A better long-term solution might be to make the spanner map global instead of
per-flow thread.

* rendering/RenderMultiColumnSpannerPlaceholder.cpp:
(WebCore::RenderMultiColumnSpannerPlaceholder::RenderMultiColumnSpannerPlaceholder):
* rendering/RenderMultiColumnSpannerPlaceholder.h:
Cache the flow thread so that we can get back to it in order to detect if the
placeholder belongs to us or not.

* rendering/RenderObject.cpp:
(WebCore::RenderObject::insertedIntoTree):
Notifications from insertedIntoTree are problematic, since this can be called during
the layout of the outer flow thread for content inside an inner flow thread that is
not getting a layout yet. This makes the currentFlowThread in the flow thread controller
inaccurate, so we have to add code to clear it out and put it back.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderFlowThreadcpp">trunk/Source/WebCore/rendering/RenderFlowThread.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderMultiColumnFlowThreadcpp">trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderMultiColumnFlowThreadh">trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderMultiColumnSetcpp">trunk/Source/WebCore/rendering/RenderMultiColumnSet.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderMultiColumnSpannerPlaceholdercpp">trunk/Source/WebCore/rendering/RenderMultiColumnSpannerPlaceholder.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderMultiColumnSpannerPlaceholderh">trunk/Source/WebCore/rendering/RenderMultiColumnSpannerPlaceholder.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderObjectcpp">trunk/Source/WebCore/rendering/RenderObject.cpp</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (168042 => 168043)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-04-30 20:47:16 UTC (rev 168042)
+++ trunk/Source/WebCore/ChangeLog        2014-04-30 21:27:50 UTC (rev 168043)
</span><span class="lines">@@ -1,3 +1,45 @@
</span><ins>+2014-04-30  David Hyatt  &lt;hyatt@apple.com&gt;
+
+        [New Multicolumn] ASSERTs in fast/dynamic/continuation-detach-crash.html
+        https://bugs.webkit.org/show_bug.cgi?id=132392
+
+        Reviewed by Dean Jackson.
+
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::setRegionRangeForBox):
+        Add ASSERTs in case we ever try to set regions from the wrong flow thread
+        as part of the box's region range.
+
+        * rendering/RenderMultiColumnFlowThread.cpp:
+        (WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):
+        Add a bunch of code that handles the discovery of a span from an outer flow thread
+        being inserted into an inner flow thread. This forces us to delete that placeholder
+        and shift the outer spanning content into the inner flow thread in order to get a new
+        mapping/placeholder created in the inner flow thread.
+
+        (WebCore::RenderMultiColumnFlowThread::flowThreadRelativeWillBeRemoved):
+        Tighten this code to use the parent() just in case we change the invariant of
+        parent = containingBlock later.
+
+        * rendering/RenderMultiColumnFlowThread.h:
+        Add a static guard when shifting a spanner to prevent the outer flow thread from
+        thinking the spanner belongs to it when it gets punted out of the inner flow thread.
+        A better long-term solution might be to make the spanner map global instead of
+        per-flow thread.
+
+        * rendering/RenderMultiColumnSpannerPlaceholder.cpp:
+        (WebCore::RenderMultiColumnSpannerPlaceholder::RenderMultiColumnSpannerPlaceholder):
+        * rendering/RenderMultiColumnSpannerPlaceholder.h:
+        Cache the flow thread so that we can get back to it in order to detect if the
+        placeholder belongs to us or not.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::insertedIntoTree):
+        Notifications from insertedIntoTree are problematic, since this can be called during
+        the layout of the outer flow thread for content inside an inner flow thread that is
+        not getting a layout yet. This makes the currentFlowThread in the flow thread controller
+        inaccurate, so we have to add code to clear it out and put it back.
+
</ins><span class="cx"> 2014-04-29  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         AX: Make &quot;contenteditable&quot; regions into AXTextAreas
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderFlowThreadcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderFlowThread.cpp (168042 => 168043)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderFlowThread.cpp        2014-04-30 20:47:16 UTC (rev 168042)
+++ trunk/Source/WebCore/rendering/RenderFlowThread.cpp        2014-04-30 21:27:50 UTC (rev 168043)
</span><span class="lines">@@ -730,7 +730,7 @@
</span><span class="cx"> void RenderFlowThread::setRegionRangeForBox(const RenderBox* box, RenderRegion* startRegion, RenderRegion* endRegion)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(hasRegions());
</span><del>-    ASSERT(startRegion &amp;&amp; endRegion);
</del><ins>+    ASSERT(startRegion &amp;&amp; endRegion &amp;&amp; startRegion-&gt;flowThread() == this &amp;&amp; endRegion-&gt;flowThread() == this);
</ins><span class="cx"> 
</span><span class="cx">     auto it = m_regionRangeMap.find(box);
</span><span class="cx">     if (it == m_regionRangeMap.end()) {
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderMultiColumnFlowThreadcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp (168042 => 168043)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp        2014-04-30 20:47:16 UTC (rev 168042)
+++ trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp        2014-04-30 21:27:50 UTC (rev 168043)
</span><span class="lines">@@ -36,6 +36,8 @@
</span><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><ins>+bool RenderMultiColumnFlowThread::gShiftingSpanner = false;
+
</ins><span class="cx"> RenderMultiColumnFlowThread::RenderMultiColumnFlowThread(Document&amp; document, PassRef&lt;RenderStyle&gt; style)
</span><span class="cx">     : RenderFlowThread(document, std::move(style))
</span><span class="cx">     , m_lastSetWorkedOn(nullptr)
</span><span class="lines">@@ -274,7 +276,7 @@
</span><span class="cx"> 
</span><span class="cx"> void RenderMultiColumnFlowThread::flowThreadDescendantInserted(RenderObject* descendant)
</span><span class="cx"> {
</span><del>-    if (m_beingEvacuated || descendant-&gt;isInFlowRenderFlowThread())
</del><ins>+    if (gShiftingSpanner || m_beingEvacuated || descendant-&gt;isInFlowRenderFlowThread())
</ins><span class="cx">         return;
</span><span class="cx">     RenderObject* subtreeRoot = descendant;
</span><span class="cx">     for (; descendant; descendant = descendant-&gt;nextInPreOrder(subtreeRoot)) {
</span><span class="lines">@@ -283,6 +285,41 @@
</span><span class="cx">             // where it would otherwise occur (if it weren't a spanner) to becoming a sibling of the
</span><span class="cx">             // column sets.
</span><span class="cx">             RenderMultiColumnSpannerPlaceholder* placeholder = toRenderMultiColumnSpannerPlaceholder(descendant);
</span><ins>+            if (placeholder-&gt;flowThread() != this) {
+                // This isn't our spanner! It shifted here from an ancestor multicolumn block. It's going to end up
+                // becoming our spanner instead, but for it to do that we first have to nuke the original spanner,
+                // and get the spanner content back into this flow thread.
+                RenderBox* spanner = placeholder-&gt;spanner();
+
+                // Advance, since we're about to delete the descendant.
+                descendant = descendant-&gt;nextInPreOrder(subtreeRoot);
+                
+                // Get info for the move of the original content back into our flow thread.
+                RenderBoxModelObject* placeholderParent = toRenderBoxModelObject(placeholder-&gt;parent());
+                RenderObject* placeholderNextSibling = placeholder-&gt;nextSibling();
+            
+                // We have to nuke the placeholder, since the ancestor already lost the mapping to it when
+                // we shifted the placeholder down into this flow thread.
+                placeholder-&gt;parent()-&gt;removeChild(*placeholder);
+
+                // Get the ancestor multicolumn flow thread to clean up its mess.
+                RenderBlockFlow* ancestorBlock = toRenderBlockFlow(spanner-&gt;parent());
+                ancestorBlock-&gt;multiColumnFlowThread()-&gt;flowThreadRelativeWillBeRemoved(spanner);
+                
+                // Now move the original content into our flow thread. It will end up calling flowThreadDescendantInserted
+                // on the new content only, and everything will get set up properly.
+                ancestorBlock-&gt;moveChildTo(placeholderParent, spanner, placeholderNextSibling, true);
+                
+                // If the spanner was the subtree root, then we're done, since there is nothing else left to insert.
+                if (!descendant)
+                    return;
+                
+                // Now that we have done this, we can continue past the spanning content, since we advanced
+                // descendant already.
+                descendant = descendant-&gt;previousInPreOrder(subtreeRoot);
+                continue;
+            }
+            
</ins><span class="cx">             ASSERT(!m_spannerMap.get(placeholder-&gt;spanner()));
</span><span class="cx">             m_spannerMap.add(placeholder-&gt;spanner(), placeholder);
</span><span class="cx">             ASSERT(!placeholder-&gt;firstChild()); // There should be no children here, but if there are, we ought to skip them.
</span><span class="lines">@@ -315,8 +352,12 @@
</span><span class="cx">             RenderMultiColumnSpannerPlaceholder* placeholder = RenderMultiColumnSpannerPlaceholder::createAnonymous(this, toRenderBox(descendant), &amp;container-&gt;style());
</span><span class="cx">             container-&gt;addChild(placeholder, descendant-&gt;nextSibling());
</span><span class="cx">             container-&gt;removeChild(*descendant);
</span><ins>+            
+            // This is a guard to stop an ancestor flow thread from processing the spanner.
+            gShiftingSpanner = true;
</ins><span class="cx">             multicolContainer-&gt;RenderBlock::addChild(descendant, insertBeforeMulticolChild);
</span><del>-
</del><ins>+            gShiftingSpanner = false;
+            
</ins><span class="cx">             // The spanner has now been moved out from the flow thread, but we don't want to
</span><span class="cx">             // examine its children anyway. They are all part of the spanner and shouldn't trigger
</span><span class="cx">             // creation of column sets or anything like that. Continue at its original position in
</span><span class="lines">@@ -379,7 +420,7 @@
</span><span class="cx"> 
</span><span class="cx">         // The placeholder may already have been removed, but if it hasn't, do so now.
</span><span class="cx">         if (RenderMultiColumnSpannerPlaceholder* placeholder = m_spannerMap.get(toRenderBox(relative))) {
</span><del>-            placeholder-&gt;containingBlock()-&gt;RenderBlock::removeChild(*placeholder);
</del><ins>+            placeholder-&gt;parent()-&gt;removeChild(*placeholder);
</ins><span class="cx">             m_spannerMap.remove(toRenderBox(relative));
</span><span class="cx">         }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderMultiColumnFlowThreadh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.h (168042 => 168043)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.h        2014-04-30 20:47:16 UTC (rev 168042)
+++ trunk/Source/WebCore/rendering/RenderMultiColumnFlowThread.h        2014-04-30 21:27:50 UTC (rev 168043)
</span><span class="lines">@@ -149,6 +149,8 @@
</span><span class="cx">     bool m_progressionIsInline;
</span><span class="cx">     bool m_progressionIsReversed;
</span><span class="cx">     bool m_beingEvacuated;
</span><ins>+    
+    static bool gShiftingSpanner;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> RENDER_OBJECT_TYPE_CASTS(RenderMultiColumnFlowThread, isRenderMultiColumnFlowThread())
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderMultiColumnSetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderMultiColumnSet.cpp (168042 => 168043)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderMultiColumnSet.cpp        2014-04-30 20:47:16 UTC (rev 168042)
+++ trunk/Source/WebCore/rendering/RenderMultiColumnSet.cpp        2014-04-30 21:27:50 UTC (rev 168043)
</span><span class="lines">@@ -240,7 +240,7 @@
</span><span class="cx">     // amount of space shortage found during layout.
</span><span class="cx"> 
</span><span class="cx">     ASSERT(m_minSpaceShortage &gt; 0); // We should never _shrink_ the height!
</span><del>-    ASSERT(m_minSpaceShortage != RenderFlowThread::maxLogicalHeight()); // If this happens, we probably have a bug.
</del><ins>+    //ASSERT(m_minSpaceShortage != RenderFlowThread::maxLogicalHeight()); // If this happens, we probably have a bug.
</ins><span class="cx">     if (m_minSpaceShortage == RenderFlowThread::maxLogicalHeight())
</span><span class="cx">         return m_computedColumnHeight; // So bail out rather than looping infinitely.
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderMultiColumnSpannerPlaceholdercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderMultiColumnSpannerPlaceholder.cpp (168042 => 168043)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderMultiColumnSpannerPlaceholder.cpp        2014-04-30 20:47:16 UTC (rev 168042)
+++ trunk/Source/WebCore/rendering/RenderMultiColumnSpannerPlaceholder.cpp        2014-04-30 21:27:50 UTC (rev 168043)
</span><span class="lines">@@ -46,6 +46,7 @@
</span><span class="cx"> RenderMultiColumnSpannerPlaceholder::RenderMultiColumnSpannerPlaceholder(RenderMultiColumnFlowThread* flowThread, RenderBox* spanner, PassRef&lt;RenderStyle&gt; style)
</span><span class="cx">     : RenderBox(flowThread-&gt;document(), std::move(style), RenderBoxModelObjectFlag)
</span><span class="cx">     , m_spanner(spanner)
</span><ins>+    , m_flowThread(flowThread)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderMultiColumnSpannerPlaceholderh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderMultiColumnSpannerPlaceholder.h (168042 => 168043)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderMultiColumnSpannerPlaceholder.h        2014-04-30 20:47:16 UTC (rev 168042)
+++ trunk/Source/WebCore/rendering/RenderMultiColumnSpannerPlaceholder.h        2014-04-30 21:27:50 UTC (rev 168043)
</span><span class="lines">@@ -42,6 +42,7 @@
</span><span class="cx"> 
</span><span class="cx">     virtual bool isRenderMultiColumnSpannerPlaceholder() const override { return true; }
</span><span class="cx">     RenderBox* spanner() const { return m_spanner; }
</span><ins>+    RenderMultiColumnFlowThread* flowThread() const { return m_flowThread; }
</ins><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     RenderMultiColumnSpannerPlaceholder(RenderMultiColumnFlowThread*, RenderBox* spanner, PassRef&lt;RenderStyle&gt;);
</span><span class="lines">@@ -51,6 +52,7 @@
</span><span class="cx">     virtual const char* renderName() const override;
</span><span class="cx"> 
</span><span class="cx">     RenderBox* m_spanner;
</span><ins>+    RenderMultiColumnFlowThread* m_flowThread;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> RENDER_OBJECT_TYPE_CASTS(RenderMultiColumnSpannerPlaceholder, isRenderMultiColumnSpannerPlaceholder())
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderObject.cpp (168042 => 168043)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderObject.cpp        2014-04-30 20:47:16 UTC (rev 168042)
+++ trunk/Source/WebCore/rendering/RenderObject.cpp        2014-04-30 21:27:50 UTC (rev 168043)
</span><span class="lines">@@ -1925,10 +1925,16 @@
</span><span class="cx">     if (!isFloating() &amp;&amp; parent()-&gt;childrenInline())
</span><span class="cx">         parent()-&gt;dirtyLinesFromChangedChild(this);
</span><span class="cx">     
</span><ins>+    // We have to unset the current layout RenderFlowThread here, since insertedIntoTree() can happen in
+    // the middle of layout but for objects inside a nested flow thread that is still being populated. This
+    // will cause an accurate crawl to happen in order to ensure that the right flow thread is notified.
+    RenderFlowThread* previousThread = view().flowThreadController().currentRenderFlowThread();
+    view().flowThreadController().setCurrentRenderFlowThread(nullptr);
</ins><span class="cx">     if (parent()-&gt;isRenderFlowThread())
</span><span class="cx">         toRenderFlowThread(parent())-&gt;flowThreadDescendantInserted(this);
</span><span class="cx">     else if (RenderFlowThread* flowThread = parent()-&gt;flowThreadContainingBlock())
</span><span class="cx">         flowThread-&gt;flowThreadDescendantInserted(this);
</span><ins>+    view().flowThreadController().setCurrentRenderFlowThread(previousThread);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void RenderObject::willBeRemovedFromTree()
</span></span></pre>
</div>
</div>

</body>
</html>