<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[174761] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/174761">174761</a></dd>
<dt>Author</dt> <dd>abucur@adobe.com</dd>
<dt>Date</dt> <dd>2014-10-15 23:50:30 -0700 (Wed, 15 Oct 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>ASSERTION  FAILED in WebCore::RenderFlowThread::getRegionRangeForBox
https://bugs.webkit.org/show_bug.cgi?id=135563

Reviewed by David Hyatt.

Source/WebCore:

The new multi-column code doesn't work correctly when the document contains nested fragmentation
contexts. The problem is the current flow thread concept that can store only one RenderFlowThread
at a time and use it during layout.

The stored flow thread is always correct for regions because named flow threads are absolutley positioned
so every child renderer is contained inside them (with the expcetion of fixed positioned elements which are
treated separately).

For multi-column elements this is no longer the case. An absolutely positioned element inside a static
multi-column element will be contained by a block outside the fragmentation context. It can even be
contained by a different multi-column element in the case of nested flow threads.

The patch below explores a solution that's not based on a current flow thread stored globally. The proposed
patch makes every block to store a pointer to its fragmentation context and a flag that states if this pointer
needs to be updated or not. If the renderer is not a block it will get its flow thread from the containing
block. Once the containing flow thread is requested for the block, the pointer is computed and cached until
invalidated:
- when a subtree is removed from a flow thread
- when the position property of an element inside a flow thread changes

The process is recursive and it doesn't affect elements that are not nested inside a flow thread. If a block
changes position from relative to static, any element that was contained by it can only be contained by an
ancestor of the block. This ancestor will still be outside of any flow thread. This ensures that non-fragmentation
code is not affected from a performance perspective.

The patch affects the results of the performance tests:
- the regions layout tests have a decreased performance raging from 2% to 5-6%
- the regions selection tests have an increased performance raging from 1-2% to 10%
- the multicolumn layout tests (now pending review in b137687) have an increased performance
raging from 1.8% to 5%

Tests: fast/multicol/multicol-all-positioned-crash.html
       fast/multicol/multicol-transform-containing-block.html

* rendering/FlowThreadController.cpp:
(WebCore::FlowThreadController::FlowThreadController):
* rendering/FlowThreadController.h:
(WebCore::FlowThreadController::currentRenderFlowThread): Deleted.
(WebCore::FlowThreadController::setCurrentRenderFlowThread): Deleted.
* rendering/LayoutState.h:
(WebCore::LayoutState::currentRenderFlowThread):
(WebCore::LayoutState::setCurrentRenderFlowThread):
* rendering/RenderBlock.cpp:
(WebCore::RenderBlockRareData::RenderBlockRareData):
(WebCore::RenderBlock::styleWillChange):
(WebCore::RenderBlock::styleDidChange):
(WebCore::RenderBlock::collapseAnonymousBoxChild):
(WebCore::RenderBlock::cachedFlowThreadContainingBlock):
(WebCore::RenderBlock::cachedFlowThreadContainingBlockNeedsUpdate):
(WebCore::RenderBlock::setCachedFlowThreadContainingBlockNeedsUpdate):
(WebCore::RenderBlock::updateCachedFlowThreadContainingBlock):
(WebCore::RenderBlock::locateFlowThreadContainingBlock):
* rendering/RenderBlock.h:
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::styleWillChange):
* rendering/RenderBox.cpp:
(WebCore::RenderBox::borderBoxRectInRegion):
* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::layout):
(WebCore::RenderFlowThread::updateAllLayerToRegionMappings):
(WebCore::RenderFlowThread::repaintRectangleInRegions):
(WebCore::CurrentRenderFlowThreadMaintainer::CurrentRenderFlowThreadMaintainer): Deleted.
(WebCore::CurrentRenderFlowThreadMaintainer::~CurrentRenderFlowThreadMaintainer): Deleted.
(WebCore::CurrentRenderFlowThreadDisabler::CurrentRenderFlowThreadDisabler): Deleted.
(WebCore::CurrentRenderFlowThreadDisabler::~CurrentRenderFlowThreadDisabler): Deleted.
* rendering/RenderFlowThread.h:
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::paintLayer):
(WebCore::RenderLayer::hitTestLayer):
(WebCore::RenderLayer::mapLayerClipRectsToFragmentationLayer):
(WebCore::RenderLayer::calculateClipRects):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::showRegionsInformation):
(WebCore::RenderObject::insertedIntoTree):
(WebCore::RenderObject::removeFromRenderFlowThread):
(WebCore::RenderObject::removeFromRenderFlowThreadIncludingDescendants):
(WebCore::RenderObject::invalidateFlowThreadContainingBlockIncludingDescendants):
(WebCore::RenderObject::currentRenderNamedFlowFragment):
(WebCore::RenderObject::locateFlowThreadContainingBlock):
(WebCore::RenderObject::locateFlowThreadContainingBlockNoCache): Deleted.
(WebCore::RenderObject::removeFromRenderFlowThreadRecursive): Deleted.
* rendering/RenderObject.h:
(WebCore::RenderObject::flowThreadContainingBlock):
* rendering/RenderRegion.cpp:
(WebCore::RenderRegion::computeOverflowFromFlowThread):
* rendering/RenderView.cpp:
(WebCore::RenderView::pushLayoutStateForCurrentFlowThread):
(WebCore::RenderView::popLayoutStateForCurrentFlowThread):
* rendering/RenderView.h:

LayoutTests:

A test verifying that positioned elements inside multi-column containers don't
cause assertions or crashes.

* fast/multicol/multicol-all-positioned-crash-expected.txt: Added.
* fast/multicol/multicol-all-positioned-crash.html: Added.
* fast/multicol/multicol-transform-containing-block-expected.txt: Added.
* fast/multicol/multicol-transform-containing-block.html: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorerenderingFlowThreadControllercpp">trunk/Source/WebCore/rendering/FlowThreadController.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingFlowThreadControllerh">trunk/Source/WebCore/rendering/FlowThreadController.h</a></li>
<li><a href="#trunkSourceWebCorerenderingLayoutStateh">trunk/Source/WebCore/rendering/LayoutState.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockcpp">trunk/Source/WebCore/rendering/RenderBlock.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockh">trunk/Source/WebCore/rendering/RenderBlock.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBlockFlowcpp">trunk/Source/WebCore/rendering/RenderBlockFlow.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderBoxcpp">trunk/Source/WebCore/rendering/RenderBox.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderFlowThreadcpp">trunk/Source/WebCore/rendering/RenderFlowThread.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderFlowThreadh">trunk/Source/WebCore/rendering/RenderFlowThread.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderLayercpp">trunk/Source/WebCore/rendering/RenderLayer.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderObjectcpp">trunk/Source/WebCore/rendering/RenderObject.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderObjecth">trunk/Source/WebCore/rendering/RenderObject.h</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderRegioncpp">trunk/Source/WebCore/rendering/RenderRegion.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderViewcpp">trunk/Source/WebCore/rendering/RenderView.cpp</a></li>
<li><a href="#trunkSourceWebCorerenderingRenderViewh">trunk/Source/WebCore/rendering/RenderView.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsfastmulticolmulticolallpositionedcrashexpectedtxt">trunk/LayoutTests/fast/multicol/multicol-all-positioned-crash-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastmulticolmulticolallpositionedcrashhtml">trunk/LayoutTests/fast/multicol/multicol-all-positioned-crash.html</a></li>
<li><a href="#trunkLayoutTestsfastmulticolmulticoltransformcontainingblockexpectedtxt">trunk/LayoutTests/fast/multicol/multicol-transform-containing-block-expected.txt</a></li>
<li><a href="#trunkLayoutTestsfastmulticolmulticoltransformcontainingblockhtml">trunk/LayoutTests/fast/multicol/multicol-transform-containing-block.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/LayoutTests/ChangeLog        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -1,3 +1,18 @@
</span><ins>+2014-10-15  Andrei Bucur  &lt;abucur@adobe.com&gt;
+
+        ASSERTION  FAILED in WebCore::RenderFlowThread::getRegionRangeForBox
+        https://bugs.webkit.org/show_bug.cgi?id=135563
+
+        Reviewed by David Hyatt.
+
+        A test verifying that positioned elements inside multi-column containers don't
+        cause assertions or crashes.
+
+        * fast/multicol/multicol-all-positioned-crash-expected.txt: Added.
+        * fast/multicol/multicol-all-positioned-crash.html: Added.
+        * fast/multicol/multicol-transform-containing-block-expected.txt: Added.
+        * fast/multicol/multicol-transform-containing-block.html: Added.
+
</ins><span class="cx"> 2014-10-15  Commit Queue  &lt;commit-queue@webkit.org&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed, rolling out r174753.
</span></span></pre></div>
<a id="trunkLayoutTestsfastmulticolmulticolallpositionedcrashexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/multicol/multicol-all-positioned-crash-expected.txt (0 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/multicol/multicol-all-positioned-crash-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/multicol/multicol-all-positioned-crash-expected.txt        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -0,0 +1 @@
</span><ins>+Test for the bug 135563. It should not crash or assert.
</ins></span></pre></div>
<a id="trunkLayoutTestsfastmulticolmulticolallpositionedcrashhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/multicol/multicol-all-positioned-crash.html (0 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/multicol/multicol-all-positioned-crash.html                                (rev 0)
+++ trunk/LayoutTests/fast/multicol/multicol-all-positioned-crash.html        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -0,0 +1,17 @@
</span><ins>+&lt;html&gt;
+&lt;head&gt;
+&lt;style&gt;
+* {
+    -webkit-columns: 2;
+    position: absolute;
+}
+&lt;/style&gt;
+&lt;/head&gt;
+&lt;body&gt;
+Test for &lt;a href=&quot;https://bugs.webkit.org/show_bug.cgi?id=135563&quot;&gt;the bug 135563&lt;/a&gt;. It should not crash or assert.
+&lt;script&gt;
+if (window.testRunner)
+    window.testRunner.dumpAsText();
+&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsfastmulticolmulticoltransformcontainingblockexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/multicol/multicol-transform-containing-block-expected.txt (0 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/multicol/multicol-transform-containing-block-expected.txt                                (rev 0)
+++ trunk/LayoutTests/fast/multicol/multicol-transform-containing-block-expected.txt        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -0,0 +1 @@
</span><ins>+Test for b135563. It should not crash or assert.
</ins></span></pre></div>
<a id="trunkLayoutTestsfastmulticolmulticoltransformcontainingblockhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/fast/multicol/multicol-transform-containing-block.html (0 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/fast/multicol/multicol-transform-containing-block.html                                (rev 0)
+++ trunk/LayoutTests/fast/multicol/multicol-transform-containing-block.html        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -0,0 +1,57 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;style&gt;
+    #pos {
+        position: absolute;
+        top: 10px;
+        left: 10px;
+    }
+
+    .multicol {
+        -webkit-column-count: 2;
+        height: 300px;
+    }
+
+    #transformed {
+        background: red;
+        width: 10px;
+        height: 10px;
+    }
+
+    .update {
+        -webkit-transform: rotate(-10deg);
+    }
+
+    .parent {
+        height: 400px;
+    }
+
+    .container {
+        padding: 50px;
+        margin: 20px;
+    }
+&lt;/style&gt;
+&lt;body&gt;
+&lt;div class=&quot;multicol parent&quot;&gt;
+    &lt;div id=&quot;change&quot; class=&quot;container&quot;&gt;
+        &lt;div class=&quot;multicol&quot;&gt;
+            &lt;div&gt;Static&lt;/div&gt;
+            &lt;div&gt;Static&lt;/div&gt;
+            &lt;div&gt;Static&lt;/div&gt;
+            &lt;div id=&quot;pos&quot;&gt;Positioned&lt;/div&gt;
+            &lt;div&gt;Static&lt;/div&gt;
+            &lt;div&gt;Static&lt;/div&gt;
+        &lt;/div&gt;
+    &lt;/div&gt;
+&lt;/div&gt;
+&lt;script type=&quot;text/javascript&quot;&gt;
+    if (window.testRunner)
+        window.testRunner.dumpAsText();
+
+    document.body.offsetTop;
+    document.getElementById(&quot;change&quot;).className += &quot; update&quot;;
+    document.body.offsetTop;
+    document.body.innerHTML = &quot;Test for b135563. It should not crash or assert.&quot;;
+&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/ChangeLog        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -1,3 +1,100 @@
</span><ins>+2014-10-15  Andrei Bucur  &lt;abucur@adobe.com&gt;
+
+        ASSERTION  FAILED in WebCore::RenderFlowThread::getRegionRangeForBox
+        https://bugs.webkit.org/show_bug.cgi?id=135563
+
+        Reviewed by David Hyatt.
+
+        The new multi-column code doesn't work correctly when the document contains nested fragmentation
+        contexts. The problem is the current flow thread concept that can store only one RenderFlowThread
+        at a time and use it during layout.
+
+        The stored flow thread is always correct for regions because named flow threads are absolutley positioned
+        so every child renderer is contained inside them (with the expcetion of fixed positioned elements which are
+        treated separately).
+
+        For multi-column elements this is no longer the case. An absolutely positioned element inside a static
+        multi-column element will be contained by a block outside the fragmentation context. It can even be
+        contained by a different multi-column element in the case of nested flow threads.
+
+        The patch below explores a solution that's not based on a current flow thread stored globally. The proposed
+        patch makes every block to store a pointer to its fragmentation context and a flag that states if this pointer
+        needs to be updated or not. If the renderer is not a block it will get its flow thread from the containing
+        block. Once the containing flow thread is requested for the block, the pointer is computed and cached until
+        invalidated:
+        - when a subtree is removed from a flow thread
+        - when the position property of an element inside a flow thread changes
+
+        The process is recursive and it doesn't affect elements that are not nested inside a flow thread. If a block
+        changes position from relative to static, any element that was contained by it can only be contained by an
+        ancestor of the block. This ancestor will still be outside of any flow thread. This ensures that non-fragmentation
+        code is not affected from a performance perspective.
+
+        The patch affects the results of the performance tests:
+        - the regions layout tests have a decreased performance raging from 2% to 5-6%
+        - the regions selection tests have an increased performance raging from 1-2% to 10%
+        - the multicolumn layout tests (now pending review in b137687) have an increased performance
+        raging from 1.8% to 5%
+
+        Tests: fast/multicol/multicol-all-positioned-crash.html
+               fast/multicol/multicol-transform-containing-block.html
+
+        * rendering/FlowThreadController.cpp:
+        (WebCore::FlowThreadController::FlowThreadController):
+        * rendering/FlowThreadController.h:
+        (WebCore::FlowThreadController::currentRenderFlowThread): Deleted.
+        (WebCore::FlowThreadController::setCurrentRenderFlowThread): Deleted.
+        * rendering/LayoutState.h:
+        (WebCore::LayoutState::currentRenderFlowThread):
+        (WebCore::LayoutState::setCurrentRenderFlowThread):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlockRareData::RenderBlockRareData):
+        (WebCore::RenderBlock::styleWillChange):
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::RenderBlock::collapseAnonymousBoxChild):
+        (WebCore::RenderBlock::cachedFlowThreadContainingBlock):
+        (WebCore::RenderBlock::cachedFlowThreadContainingBlockNeedsUpdate):
+        (WebCore::RenderBlock::setCachedFlowThreadContainingBlockNeedsUpdate):
+        (WebCore::RenderBlock::updateCachedFlowThreadContainingBlock):
+        (WebCore::RenderBlock::locateFlowThreadContainingBlock):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockFlow.cpp:
+        (WebCore::RenderBlockFlow::styleWillChange):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::borderBoxRectInRegion):
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::layout):
+        (WebCore::RenderFlowThread::updateAllLayerToRegionMappings):
+        (WebCore::RenderFlowThread::repaintRectangleInRegions):
+        (WebCore::CurrentRenderFlowThreadMaintainer::CurrentRenderFlowThreadMaintainer): Deleted.
+        (WebCore::CurrentRenderFlowThreadMaintainer::~CurrentRenderFlowThreadMaintainer): Deleted.
+        (WebCore::CurrentRenderFlowThreadDisabler::CurrentRenderFlowThreadDisabler): Deleted.
+        (WebCore::CurrentRenderFlowThreadDisabler::~CurrentRenderFlowThreadDisabler): Deleted.
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::mapLayerClipRectsToFragmentationLayer):
+        (WebCore::RenderLayer::calculateClipRects):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::showRegionsInformation):
+        (WebCore::RenderObject::insertedIntoTree):
+        (WebCore::RenderObject::removeFromRenderFlowThread):
+        (WebCore::RenderObject::removeFromRenderFlowThreadIncludingDescendants):
+        (WebCore::RenderObject::invalidateFlowThreadContainingBlockIncludingDescendants):
+        (WebCore::RenderObject::currentRenderNamedFlowFragment):
+        (WebCore::RenderObject::locateFlowThreadContainingBlock):
+        (WebCore::RenderObject::locateFlowThreadContainingBlockNoCache): Deleted.
+        (WebCore::RenderObject::removeFromRenderFlowThreadRecursive): Deleted.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::flowThreadContainingBlock):
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::computeOverflowFromFlowThread):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::pushLayoutStateForCurrentFlowThread):
+        (WebCore::RenderView::popLayoutStateForCurrentFlowThread):
+        * rendering/RenderView.h:
+
</ins><span class="cx"> 2014-10-15  Chris Dumez  &lt;cdumez@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Use is&lt;&gt;() / downcast&lt;&gt;() for list-related render objects
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingFlowThreadControllercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/FlowThreadController.cpp (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/FlowThreadController.cpp        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/rendering/FlowThreadController.cpp        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -42,7 +42,6 @@
</span><span class="cx"> 
</span><span class="cx"> FlowThreadController::FlowThreadController(RenderView* view)
</span><span class="cx">     : m_view(view)
</span><del>-    , m_currentRenderFlowThread(0)
</del><span class="cx">     , m_isRenderNamedFlowThreadOrderDirty(false)
</span><span class="cx">     , m_flowThreadsWithAutoLogicalHeightRegions(0)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingFlowThreadControllerh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/FlowThreadController.h (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/FlowThreadController.h        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/rendering/FlowThreadController.h        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -48,9 +48,6 @@
</span><span class="cx">     explicit FlowThreadController(RenderView*);
</span><span class="cx">     ~FlowThreadController();
</span><span class="cx"> 
</span><del>-    RenderFlowThread* currentRenderFlowThread() const { return m_currentRenderFlowThread; }
-    void setCurrentRenderFlowThread(RenderFlowThread* flowThread) { m_currentRenderFlowThread = flowThread; }
-
</del><span class="cx">     bool isRenderNamedFlowThreadOrderDirty() const { return m_isRenderNamedFlowThreadOrderDirty; }
</span><span class="cx">     void setIsRenderNamedFlowThreadOrderDirty(bool dirty)
</span><span class="cx">     {
</span><span class="lines">@@ -96,7 +93,6 @@
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     RenderView* m_view;
</span><del>-    RenderFlowThread* m_currentRenderFlowThread;
</del><span class="cx">     bool m_isRenderNamedFlowThreadOrderDirty;
</span><span class="cx">     unsigned m_flowThreadsWithAutoLogicalHeightRegions;
</span><span class="cx">     std::unique_ptr&lt;RenderNamedFlowThreadList&gt; m_renderNamedFlowThreadList;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingLayoutStateh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/LayoutState.h (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/LayoutState.h        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/rendering/LayoutState.h        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -83,6 +83,10 @@
</span><span class="cx">     void setLineGridPaginationOrigin(const LayoutSize&amp; origin) { m_lineGridPaginationOrigin = origin; }
</span><span class="cx">     
</span><span class="cx">     bool needsBlockDirectionLocationSetBeforeLayout() const { return m_lineGrid || (m_isPaginated &amp;&amp; m_pageLogicalHeight); }
</span><ins>+
+    RenderFlowThread* currentRenderFlowThread() const { return m_currentRenderFlowThread; }
+    void setCurrentRenderFlowThread(RenderFlowThread* flowThread) { m_currentRenderFlowThread = flowThread; }
+
</ins><span class="cx"> private:
</span><span class="cx">     void propagateLineGridInfo(RenderBox*);
</span><span class="cx">     void establishLineGrid(RenderBlockFlow*);
</span><span class="lines">@@ -122,6 +126,8 @@
</span><span class="cx">     LayoutSize m_lineGridOffset;
</span><span class="cx">     LayoutSize m_lineGridPaginationOrigin;
</span><span class="cx"> 
</span><ins>+    RenderFlowThread* m_currentRenderFlowThread { nullptr };
+
</ins><span class="cx"> #ifndef NDEBUG
</span><span class="cx">     RenderObject* m_renderer;
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlock.cpp (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlock.cpp        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/rendering/RenderBlock.cpp        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -68,7 +68,9 @@
</span><span class="cx"> #include &quot;ShadowRoot.h&quot;
</span><span class="cx"> #include &quot;TextBreakIterator.h&quot;
</span><span class="cx"> #include &quot;TransformState.h&quot;
</span><ins>+
</ins><span class="cx"> #include &lt;wtf/NeverDestroyed.h&gt;
</span><ins>+#include &lt;wtf/Optional.h&gt;
</ins><span class="cx"> #include &lt;wtf/StackStats.h&gt;
</span><span class="cx"> #include &lt;wtf/TemporaryChange.h&gt;
</span><span class="cx"> 
</span><span class="lines">@@ -94,7 +96,7 @@
</span><span class="cx"> 
</span><span class="cx"> static TrackedContainerMap* gPositionedContainerMap = 0;
</span><span class="cx"> static TrackedContainerMap* gPercentHeightContainerMap = 0;
</span><del>-    
</del><ins>+
</ins><span class="cx"> typedef HashMap&lt;RenderBlock*, std::unique_ptr&lt;ListHashSet&lt;RenderInline*&gt;&gt;&gt; ContinuationOutlineTableMap;
</span><span class="cx"> 
</span><span class="cx"> struct UpdateScrollInfoAfterLayoutTransaction {
</span><span class="lines">@@ -121,14 +123,17 @@
</span><span class="cx"> struct RenderBlockRareData {
</span><span class="cx">     WTF_MAKE_NONCOPYABLE(RenderBlockRareData); WTF_MAKE_FAST_ALLOCATED;
</span><span class="cx"> public:
</span><del>-    RenderBlockRareData() 
</del><ins>+    RenderBlockRareData()
</ins><span class="cx">         : m_paginationStrut(0)
</span><span class="cx">         , m_pageLogicalOffset(0)
</span><del>-    { 
</del><ins>+        , m_flowThreadContainingBlock(Nullopt)
+    {
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     LayoutUnit m_paginationStrut;
</span><span class="cx">     LayoutUnit m_pageLogicalOffset;
</span><ins>+
+    Optional&lt;RenderFlowThread*&gt; m_flowThreadContainingBlock;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> typedef HashMap&lt;const RenderBlock*, std::unique_ptr&lt;RenderBlockRareData&gt;&gt; RenderBlockRareDataMap;
</span><span class="lines">@@ -266,7 +271,7 @@
</span><span class="cx">     const RenderStyle* oldStyle = hasInitializedStyle() ? &amp;style() : nullptr;
</span><span class="cx"> 
</span><span class="cx">     setReplaced(newStyle.isDisplayInlineType());
</span><del>-    
</del><ins>+
</ins><span class="cx">     if (oldStyle &amp;&amp; parent() &amp;&amp; diff == StyleDifferenceLayout &amp;&amp; oldStyle-&gt;position() != newStyle.position()) {
</span><span class="cx">         if (newStyle.position() == StaticPosition)
</span><span class="cx">             // Clear our positioned objects list. Our absolutely positioned descendants will be
</span><span class="lines">@@ -283,7 +288,7 @@
</span><span class="cx">                 }
</span><span class="cx">                 containingBlock = containingBlock-&gt;parent();
</span><span class="cx">             }
</span><del>-            
</del><ins>+
</ins><span class="cx">             if (is&lt;RenderBlock&gt;(*containingBlock))
</span><span class="cx">                 downcast&lt;RenderBlock&gt;(*containingBlock).removePositionedObjects(this, NewContainingBlock);
</span><span class="cx">         }
</span><span class="lines">@@ -308,10 +313,20 @@
</span><span class="cx"> 
</span><span class="cx"> void RenderBlock::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
</span><span class="cx"> {
</span><del>-    RenderBox::styleDidChange(diff, oldStyle);
-    
</del><span class="cx">     RenderStyle&amp; newStyle = style();
</span><span class="cx"> 
</span><ins>+    bool hadTransform = hasTransform();
+    bool flowThreadContainingBlockInvalidated = false;
+    if (oldStyle &amp;&amp; oldStyle-&gt;position() != newStyle.position()) {
+        invalidateFlowThreadContainingBlockIncludingDescendants();
+        flowThreadContainingBlockInvalidated = true;
+    }
+
+    RenderBox::styleDidChange(diff, oldStyle);
+
+    if (hadTransform != hasTransform() &amp;&amp; !flowThreadContainingBlockInvalidated)
+        invalidateFlowThreadContainingBlockIncludingDescendants();
+
</ins><span class="cx">     if (!isAnonymousBlock()) {
</span><span class="cx">         // Ensure that all of our continuation blocks pick up the new style.
</span><span class="cx">         for (RenderBlock* currCont = blockElementContinuation(); currCont; currCont = currCont-&gt;blockElementContinuation()) {
</span><span class="lines">@@ -324,7 +339,7 @@
</span><span class="cx"> 
</span><span class="cx">     propagateStyleToAnonymousChildren(PropagateToBlockChildrenOnly);
</span><span class="cx">     m_lineHeight = -1;
</span><del>-    
</del><ins>+
</ins><span class="cx">     // It's possible for our border/padding to change, but for the overall logical width of the block to
</span><span class="cx">     // end up being the same. We keep track of this change so in layoutBlock, we can know to set relayoutChildren=true.
</span><span class="cx">     m_hasBorderOrPaddingLogicalWidthChanged = oldStyle &amp;&amp; diff == StyleDifferenceLayout &amp;&amp; needsLayout() &amp;&amp; borderOrPaddingLogicalWidthChanged(oldStyle, &amp;newStyle);
</span><span class="lines">@@ -690,7 +705,6 @@
</span><span class="cx">     RenderObject* nextSibling = child-&gt;nextSibling();
</span><span class="cx"> 
</span><span class="cx">     RenderFlowThread* childFlowThread = child-&gt;flowThreadContainingBlock();
</span><del>-    CurrentRenderFlowThreadMaintainer flowThreadMaintainer(childFlowThread);
</del><span class="cx">     if (childFlowThread &amp;&amp; childFlowThread-&gt;isRenderNamedFlowThread())
</span><span class="cx">         toRenderNamedFlowThread(childFlowThread)-&gt;removeFlowChildInfo(child);
</span><span class="cx"> 
</span><span class="lines">@@ -3254,6 +3268,50 @@
</span><span class="cx">     createFirstLetterRenderer(firstLetterContainer, downcast&lt;RenderText&gt;(firstLetterObj));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+RenderFlowThread* RenderBlock::cachedFlowThreadContainingBlock() const
+{
+    RenderBlockRareData* rareData = getRareData(this);
+
+    if (!rareData || !rareData-&gt;m_flowThreadContainingBlock)
+        return nullptr;
+
+    return rareData-&gt;m_flowThreadContainingBlock.value();
+}
+
+bool RenderBlock::cachedFlowThreadContainingBlockNeedsUpdate() const
+{
+    RenderBlockRareData* rareData = getRareData(this);
+
+    if (!rareData || !rareData-&gt;m_flowThreadContainingBlock)
+        return true;
+
+    return false;
+}
+
+void RenderBlock::setCachedFlowThreadContainingBlockNeedsUpdate()
+{
+    RenderBlockRareData&amp; rareData = ensureRareData(this);
+    rareData.m_flowThreadContainingBlock = Nullopt;
+}
+
+RenderFlowThread* RenderBlock::updateCachedFlowThreadContainingBlock(RenderFlowThread* flowThread) const
+{
+    RenderBlockRareData&amp; rareData = ensureRareData(this);
+    rareData.m_flowThreadContainingBlock = flowThread;
+
+    return flowThread;
+}
+
+RenderFlowThread* RenderBlock::locateFlowThreadContainingBlock() const
+{
+    RenderBlockRareData* rareData = getRareData(this);
+    if (!rareData || !rareData-&gt;m_flowThreadContainingBlock)
+        return updateCachedFlowThreadContainingBlock(RenderBox::locateFlowThreadContainingBlock());
+
+    ASSERT(rareData-&gt;m_flowThreadContainingBlock.value() == RenderBox::locateFlowThreadContainingBlock());
+    return rareData-&gt;m_flowThreadContainingBlock.value();
+}
+
</ins><span class="cx"> LayoutUnit RenderBlock::paginationStrut() const
</span><span class="cx"> {
</span><span class="cx">     RenderBlockRareData* rareData = getRareData(this);
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlock.h (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlock.h        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/rendering/RenderBlock.h        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -312,7 +312,12 @@
</span><span class="cx">     virtual bool canHaveChildren() const override { return true; }
</span><span class="cx">     virtual bool canCollapseAnonymousBlockChild() const { return true; }
</span><span class="cx"> 
</span><ins>+    RenderFlowThread* cachedFlowThreadContainingBlock() const;
+    void setCachedFlowThreadContainingBlockNeedsUpdate();
+    virtual bool cachedFlowThreadContainingBlockNeedsUpdate() const;
+
</ins><span class="cx"> protected:
</span><ins>+    virtual RenderFlowThread* locateFlowThreadContainingBlock() const override;
</ins><span class="cx">     virtual void willBeDestroyed() override;
</span><span class="cx"> 
</span><span class="cx">     virtual void layout() override;
</span><span class="lines">@@ -449,7 +454,7 @@
</span><span class="cx"> 
</span><span class="cx">     virtual LayoutRect rectWithOutlineForRepaint(const RenderLayerModelObject* repaintContainer, LayoutUnit outlineWidth) const override final;
</span><span class="cx">     virtual const RenderStyle&amp; outlineStyleForRepaint() const override final;
</span><del>-    
</del><ins>+
</ins><span class="cx">     virtual RenderElement* hoverAncestor() const override final;
</span><span class="cx">     virtual void updateDragState(bool dragOn) override final;
</span><span class="cx">     virtual void childBecameNonInline(RenderObject* child) override final;
</span><span class="lines">@@ -489,6 +494,8 @@
</span><span class="cx">     RenderPtr&lt;RenderBlock&gt; clone() const;
</span><span class="cx">     RenderBlock* continuationBefore(RenderObject* beforeChild);
</span><span class="cx"> 
</span><ins>+    RenderFlowThread* updateCachedFlowThreadContainingBlock(RenderFlowThread*) const;
+
</ins><span class="cx"> private:
</span><span class="cx">     bool hasRareData() const;
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBlockFlowcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBlockFlow.cpp (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBlockFlow.cpp        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/rendering/RenderBlockFlow.cpp        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -1985,18 +1985,10 @@
</span><span class="cx">     if (oldStyle) {
</span><span class="cx">         EPosition oldPosition = oldStyle-&gt;position();
</span><span class="cx">         EPosition newPosition = newStyle.position();
</span><del>-        
</del><ins>+
</ins><span class="cx">         if (parent() &amp;&amp; diff == StyleDifferenceLayout &amp;&amp; oldPosition != newPosition) {
</span><span class="cx">             if (containsFloats() &amp;&amp; !isFloating() &amp;&amp; !isOutOfFlowPositioned() &amp;&amp; newStyle.hasOutOfFlowPosition())
</span><span class="cx">                 markAllDescendantsWithFloatsForLayout();
</span><del>-
-            // If this block is inside a multicol and is moving from in-flow positioning to out-of-flow positioning,
-            // remove its info (such as lines-to-region mapping) from the flowthread because it won't be able to do it later.
-            // The flowthread will no longer be in its containing block chain and, as such, flowThreadContainingBlock will return null.
-            if (RenderFlowThread* flowThread = flowThreadContainingBlock(SkipFlowThreadCache)) {
-                if (flowThread-&gt;isRenderMultiColumnFlowThread() &amp;&amp; !isOutOfFlowPositioned() &amp;&amp; (newPosition == AbsolutePosition || newPosition == FixedPosition))
-                    flowThread-&gt;removeFlowChildInfo(this);
-            }
</del><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderBoxcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderBox.cpp (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderBox.cpp        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/rendering/RenderBox.cpp        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -196,7 +196,7 @@
</span><span class="cx">         // FIXME: In a perfect world this condition should never happen.
</span><span class="cx">         return borderBoxRect();
</span><span class="cx">     }
</span><del>-    
</del><ins>+
</ins><span class="cx">     ASSERT(flowThread-&gt;regionInRange(region, startRegion, endRegion));
</span><span class="cx"> 
</span><span class="cx">     // Compute the logical width and placement in this region.
</span><span class="lines">@@ -207,21 +207,26 @@
</span><span class="cx">     // We have cached insets.
</span><span class="cx">     LayoutUnit logicalWidth = boxInfo-&gt;logicalWidth();
</span><span class="cx">     LayoutUnit logicalLeft = boxInfo-&gt;logicalLeft();
</span><del>-        
</del><ins>+
</ins><span class="cx">     // Now apply the parent inset since it is cumulative whenever anything in the containing block chain shifts.
</span><span class="cx">     // FIXME: Doesn't work right with perpendicular writing modes.
</span><span class="cx">     const RenderBlock* currentBox = containingBlock();
</span><del>-    RenderBoxRegionInfo* currentBoxInfo = currentBox-&gt;renderBoxRegionInfo(region);
</del><ins>+    RenderBoxRegionInfo* currentBoxInfo = isRenderFlowThread() ? nullptr : currentBox-&gt;renderBoxRegionInfo(region);
</ins><span class="cx">     while (currentBoxInfo &amp;&amp; currentBoxInfo-&gt;isShifted()) {
</span><span class="cx">         if (currentBox-&gt;style().direction() == LTR)
</span><span class="cx">             logicalLeft += currentBoxInfo-&gt;logicalLeft();
</span><span class="cx">         else
</span><span class="cx">             logicalLeft -= (currentBox-&gt;logicalWidth() - currentBoxInfo-&gt;logicalWidth()) - currentBoxInfo-&gt;logicalLeft();
</span><ins>+
+        // Once we reach the fragmentation container we should stop.
+        if (currentBox-&gt;isRenderFlowThread())
+            break;
+
</ins><span class="cx">         currentBox = currentBox-&gt;containingBlock();
</span><span class="cx">         region = currentBox-&gt;clampToStartAndEndRegions(region);
</span><span class="cx">         currentBoxInfo = currentBox-&gt;renderBoxRegionInfo(region);
</span><span class="cx">     }
</span><del>-    
</del><ins>+
</ins><span class="cx">     if (cacheFlag == DoNotCacheRenderBoxRegionInfo)
</span><span class="cx">         delete boxInfo;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderFlowThreadcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderFlowThread.cpp (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderFlowThread.cpp        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/rendering/RenderFlowThread.cpp        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -197,7 +197,6 @@
</span><span class="cx"> 
</span><span class="cx">     validateRegions();
</span><span class="cx"> 
</span><del>-    CurrentRenderFlowThreadMaintainer currentFlowThreadSetter(this);
</del><span class="cx">     RenderBlockFlow::layout();
</span><span class="cx"> 
</span><span class="cx">     m_pageLogicalSizeChanged = false;
</span><span class="lines">@@ -288,10 +287,6 @@
</span><span class="cx">     if (!collectsGraphicsLayersUnderRegions())
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    // We can't use currentFlowThread as it is possible to have interleaved flow threads and the wrong one could be used.
-    // Let each region figure out the proper enclosing flow thread.
-    CurrentRenderFlowThreadDisabler disabler(&amp;view());
-
</del><span class="cx">     // If the RenderFlowThread had a z-index layer update, then we need to update the composited layers too.
</span><span class="cx">     bool needsLayerUpdate = layer()-&gt;isDirtyRenderFlowThread() || m_layersToRegionMappingsDirty || !m_layerToRegionMap.get();
</span><span class="cx">     layer()-&gt;updateLayerListsIfNeeded();
</span><span class="lines">@@ -388,10 +383,6 @@
</span><span class="cx"> 
</span><span class="cx">     LayoutStateDisabler layoutStateDisabler(&amp;view()); // We can't use layout state to repaint, since the regions are somewhere else.
</span><span class="cx"> 
</span><del>-    // We can't use currentFlowThread as it is possible to have interleaved flow threads and the wrong one could be used.
-    // Let each region figure out the proper enclosing flow thread.
-    CurrentRenderFlowThreadDisabler disabler(&amp;view());
-    
</del><span class="cx">     for (auto&amp; region : m_regionList)
</span><span class="cx">         region-&gt;repaintFlowThreadContent(repaintRect);
</span><span class="cx"> }
</span><span class="lines">@@ -1522,42 +1513,5 @@
</span><span class="cx">     return *m_lineToRegionMap.get();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-CurrentRenderFlowThreadMaintainer::CurrentRenderFlowThreadMaintainer(RenderFlowThread* renderFlowThread)
-    : m_renderFlowThread(renderFlowThread)
-    , m_previousRenderFlowThread(0)
-{
-    if (!m_renderFlowThread)
-        return;
-    FlowThreadController&amp; controller = m_renderFlowThread-&gt;view().flowThreadController();
-    m_previousRenderFlowThread = controller.currentRenderFlowThread();
-    // Remove the assert so we can use this to change the flow thread context.
-    // ASSERT(!m_previousRenderFlowThread || !renderFlowThread-&gt;isRenderNamedFlowThread());
-    controller.setCurrentRenderFlowThread(m_renderFlowThread);
-}
</del><span class="cx"> 
</span><del>-CurrentRenderFlowThreadMaintainer::~CurrentRenderFlowThreadMaintainer()
-{
-    if (!m_renderFlowThread)
-        return;
-    FlowThreadController&amp; controller = m_renderFlowThread-&gt;view().flowThreadController();
-    ASSERT(controller.currentRenderFlowThread() == m_renderFlowThread);
-    controller.setCurrentRenderFlowThread(m_previousRenderFlowThread);
-}
-
-CurrentRenderFlowThreadDisabler::CurrentRenderFlowThreadDisabler(RenderView* view)
-    : m_view(view)
-    , m_renderFlowThread(0)
-{
-    m_renderFlowThread = m_view-&gt;flowThreadController().currentRenderFlowThread();
-    if (m_renderFlowThread)
-        view-&gt;flowThreadController().setCurrentRenderFlowThread(0);
-}
-
-CurrentRenderFlowThreadDisabler::~CurrentRenderFlowThreadDisabler()
-{
-    if (m_renderFlowThread)
-        m_view-&gt;flowThreadController().setCurrentRenderFlowThread(m_renderFlowThread);
-}
-
-
</del><span class="cx"> } // namespace WebCore
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderFlowThreadh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderFlowThread.h (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderFlowThread.h        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/rendering/RenderFlowThread.h        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -231,6 +231,8 @@
</span><span class="cx"> 
</span><span class="cx">     ContainingRegionMap&amp; containingRegionMap();
</span><span class="cx"> 
</span><ins>+    virtual bool cachedFlowThreadContainingBlockNeedsUpdate() const override { return false; }
+
</ins><span class="cx">     // FIXME: Eventually as column and region flow threads start nesting, this may end up changing.
</span><span class="cx">     virtual bool shouldCheckColumnBreaks() const { return false; }
</span><span class="cx"> 
</span><span class="lines">@@ -244,6 +246,8 @@
</span><span class="cx"> protected:
</span><span class="cx">     RenderFlowThread(Document&amp;, PassRef&lt;RenderStyle&gt;);
</span><span class="cx"> 
</span><ins>+    virtual RenderFlowThread* locateFlowThreadContainingBlock() const override { return const_cast&lt;RenderFlowThread*&gt;(this); }
+
</ins><span class="cx">     virtual const char* renderName() const = 0;
</span><span class="cx"> 
</span><span class="cx">     // Overridden by columns/pages to set up an initial logical width of the page width even when
</span><span class="lines">@@ -374,26 +378,6 @@
</span><span class="cx"> 
</span><span class="cx"> RENDER_OBJECT_TYPE_CASTS(RenderFlowThread, isRenderFlowThread())
</span><span class="cx"> 
</span><del>-class CurrentRenderFlowThreadMaintainer {
-    WTF_MAKE_NONCOPYABLE(CurrentRenderFlowThreadMaintainer);
-public:
-    CurrentRenderFlowThreadMaintainer(RenderFlowThread*);
-    ~CurrentRenderFlowThreadMaintainer();
-private:
-    RenderFlowThread* m_renderFlowThread;
-    RenderFlowThread* m_previousRenderFlowThread;
-};
-
-class CurrentRenderFlowThreadDisabler {
-    WTF_MAKE_NONCOPYABLE(CurrentRenderFlowThreadDisabler);
-public:
-    CurrentRenderFlowThreadDisabler(RenderView*);
-    ~CurrentRenderFlowThreadDisabler();
-private:
-    RenderView* m_view;
-    RenderFlowThread* m_renderFlowThread;
-};
-
</del><span class="cx"> // This structure is used by PODIntervalTree for debugging.
</span><span class="cx"> #ifndef NDEBUG
</span><span class="cx"> template &lt;&gt; struct ValueToString&lt;RenderRegion*&gt; {
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderLayercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderLayer.cpp (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderLayer.cpp        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/rendering/RenderLayer.cpp        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -3771,12 +3771,6 @@
</span><span class="cx"> 
</span><span class="cx">     // Don't paint the layer if the renderer doesn't belong to this region.
</span><span class="cx">     // This is true as long as we clamp the range of a box to its containing block range.
</span><del>-
-    // Disable named flow region information for in flow threads such as multi-col.
-    std::unique_ptr&lt;CurrentRenderFlowThreadDisabler&gt; flowThreadDisabler;
-    if (enclosingPaginationLayer(ExcludeCompositedPaginatedLayers))
-        flowThreadDisabler = std::make_unique&lt;CurrentRenderFlowThreadDisabler&gt;(&amp;renderer().view());
-
</del><span class="cx">     RenderNamedFlowFragment* namedFlowFragment = currentRenderNamedFlowFragment();
</span><span class="cx">     if (namedFlowFragment) {
</span><span class="cx">         ASSERT(namedFlowFragment-&gt;isValid());
</span><span class="lines">@@ -4821,11 +4815,6 @@
</span><span class="cx">     if (!isSelfPaintingLayer() &amp;&amp; !hasSelfPaintingLayerDescendant())
</span><span class="cx">         return 0;
</span><span class="cx"> 
</span><del>-    // Disable named flow region information for in flow threads such as multi-col.
-    std::unique_ptr&lt;CurrentRenderFlowThreadDisabler&gt; flowThreadDisabler;
-    if (enclosingPaginationLayer(ExcludeCompositedPaginatedLayers))
-        flowThreadDisabler = std::make_unique&lt;CurrentRenderFlowThreadDisabler&gt;(&amp;renderer().view());
-
</del><span class="cx">     RenderNamedFlowFragment* namedFlowFragment = currentRenderNamedFlowFragment();
</span><span class="cx"> 
</span><span class="cx">     // Prevent hitting the fixed layers inside the flow thread when hitting through regions.
</span><span class="lines">@@ -5232,8 +5221,7 @@
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     ASSERT(namedFlowFragment-&gt;parent() &amp;&amp; namedFlowFragment-&gt;parent()-&gt;isRenderNamedFlowFragmentContainer());
</span><del>-    
-    CurrentRenderFlowThreadDisabler flowThreadDisabler(&amp;renderer().view());
</del><ins>+
</ins><span class="cx">     ClipRectsContext targetClipRectsContext(&amp;namedFlowFragment-&gt;fragmentContainerLayer(), TemporaryClipRects);
</span><span class="cx">     namedFlowFragment-&gt;fragmentContainerLayer().calculateClipRects(targetClipRectsContext, clipRects);
</span><span class="cx"> 
</span><span class="lines">@@ -6710,7 +6698,6 @@
</span><span class="cx"> void RenderLayer::paintNamedFlowThreadInsideRegion(GraphicsContext* context, RenderNamedFlowFragment* region, LayoutRect paintDirtyRect, LayoutPoint paintOffset, PaintBehavior paintBehavior, PaintLayerFlags paintFlags)
</span><span class="cx"> {
</span><span class="cx">     LayoutRect regionContentBox = toRenderBox(region-&gt;layerOwner()).contentBoxRect();
</span><del>-    CurrentRenderFlowThreadMaintainer flowThreadMaintainer(toRenderFlowThread(&amp;renderer()));
</del><span class="cx">     CurrentRenderRegionMaintainer regionMaintainer(*region);
</span><span class="cx">     region-&gt;setRegionObjectsRegionStyle();
</span><span class="cx"> 
</span><span class="lines">@@ -6817,7 +6804,6 @@
</span><span class="cx">         hitTestRectInFlowThread.move(hitTestOffset);
</span><span class="cx">         hitTestRectInFlowThread.expand(LayoutSize(fabs((double)hitTestOffset.width()), fabs((double)hitTestOffset.height())));
</span><span class="cx"> 
</span><del>-        CurrentRenderFlowThreadMaintainer flowThreadMaintainer(flowThread);
</del><span class="cx">         CurrentRenderRegionMaintainer regionMaintainer(region);
</span><span class="cx"> 
</span><span class="cx">         HitTestResult tempResult(result.hitTestLocation());
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderObject.cpp (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderObject.cpp        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/rendering/RenderObject.cpp        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -522,38 +522,6 @@
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RenderFlowThread* RenderObject::locateFlowThreadContainingBlockNoCache() const
-{
-    ASSERT(flowThreadState() != NotInsideFlowThread);
-
-    RenderObject* curr = const_cast&lt;RenderObject*&gt;(this);
-    while (curr) {
-        if (curr-&gt;isRenderFlowThread())
-            return toRenderFlowThread(curr);
-        curr = curr-&gt;containingBlock();
-    }
-    return 0;
-}
-
-RenderFlowThread* RenderObject::locateFlowThreadContainingBlock() const
-{
-    ASSERT(flowThreadState() != NotInsideFlowThread);
-
-    // See if we have the thread cached because we're in the middle of layout.
-    RenderFlowThread* flowThread = view().flowThreadController().currentRenderFlowThread();
-    if (flowThread &amp;&amp; (flowThreadState() == flowThread-&gt;flowThreadState())) {
-        // Make sure the slow path would return the same result as our cache.
-        // FIXME: For the moment, only apply this assertion to regions, as multicol
-        // still has some issues and triggers this assert.
-        // Created https://bugs.webkit.org/show_bug.cgi?id=132946 for this issue.
-        ASSERT(!flowThread-&gt;isRenderNamedFlowThread() || flowThread == locateFlowThreadContainingBlockNoCache());
-        return flowThread;
-    }
-    
-    // Not in the middle of layout so have to find the thread the slow way.
-    return locateFlowThreadContainingBlockNoCache();
-}
-
</del><span class="cx"> RenderBlock* RenderObject::firstLineBlock() const
</span><span class="cx"> {
</span><span class="cx">     return 0;
</span><span class="lines">@@ -1438,8 +1406,6 @@
</span><span class="cx"> 
</span><span class="cx"> void RenderObject::showRegionsInformation() const
</span><span class="cx"> {
</span><del>-    CurrentRenderFlowThreadDisabler flowThreadDisabler(&amp;view());
-
</del><span class="cx">     if (RenderFlowThread* flowThread = flowThreadContainingBlock()) {
</span><span class="cx">         const RenderBox* box = isBox() ? toRenderBox(this) : nullptr;
</span><span class="cx">         if (box) {
</span><span class="lines">@@ -2048,17 +2014,9 @@
</span><span class="cx"> 
</span><span class="cx">     if (!isFloating() &amp;&amp; parent()-&gt;childrenInline())
</span><span class="cx">         parent()-&gt;dirtyLinesFromChangedChild(*this);
</span><del>-    
-    // We have to unset the current layout RenderFlowThread here, since insertedIntoTree() can happen in
-    // the middle of layout but for objects inside a nested flow thread that is still being populated. This
-    // will cause an accurate crawl to happen in order to ensure that the right flow thread is notified.
-    RenderFlowThread* previousThread = view().flowThreadController().currentRenderFlowThread();
-    view().flowThreadController().setCurrentRenderFlowThread(nullptr);
-    if (parent()-&gt;isRenderFlowThread())
-        toRenderFlowThread(parent())-&gt;flowThreadDescendantInserted(this);
-    else if (RenderFlowThread* flowThread = parent()-&gt;flowThreadContainingBlock())
</del><ins>+
+    if (RenderFlowThread* flowThread = flowThreadContainingBlock())
</ins><span class="cx">         flowThread-&gt;flowThreadDescendantInserted(this);
</span><del>-    view().flowThreadController().setCurrentRenderFlowThread(previousThread);
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void RenderObject::willBeRemovedFromTree()
</span><span class="lines">@@ -2075,27 +2033,56 @@
</span><span class="cx"> {
</span><span class="cx">     if (flowThreadState() == NotInsideFlowThread)
</span><span class="cx">         return;
</span><del>-    
</del><ins>+
</ins><span class="cx">     // Sometimes we remove the element from the flow, but it's not destroyed at that time.
</span><del>-    // It's only until later when we actually destroy it and remove all the children from it. 
</del><ins>+    // It's only until later when we actually destroy it and remove all the children from it.
</ins><span class="cx">     // Currently, that happens for firstLetter elements and list markers.
</span><span class="cx">     // Pass in the flow thread so that we don't have to look it up for all the children.
</span><del>-    removeFromRenderFlowThreadRecursive(flowThreadContainingBlock());
</del><ins>+    removeFromRenderFlowThreadIncludingDescendants(true);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void RenderObject::removeFromRenderFlowThreadRecursive(RenderFlowThread* renderFlowThread)
</del><ins>+void RenderObject::removeFromRenderFlowThreadIncludingDescendants(bool shouldUpdateState)
</ins><span class="cx"> {
</span><ins>+    // Once we reach another flow thread we don't need to update the flow thread state
+    // but we have to continue cleanup the flow thread info.
+    if (isRenderFlowThread())
+        shouldUpdateState = false;
+
</ins><span class="cx">     for (RenderObject* child = firstChildSlow(); child; child = child-&gt;nextSibling())
</span><del>-        child-&gt;removeFromRenderFlowThreadRecursive(renderFlowThread);
</del><ins>+        child-&gt;removeFromRenderFlowThreadIncludingDescendants(shouldUpdateState);
</ins><span class="cx"> 
</span><del>-    RenderFlowThread* localFlowThread = renderFlowThread;
-    if (flowThreadState() == InsideInFlowThread)
-        localFlowThread = flowThreadContainingBlock(); // We have to ask. We can't just assume we are in the same flow thread.
-    if (localFlowThread)
-        localFlowThread-&gt;removeFlowChildInfo(this);
-    setFlowThreadState(NotInsideFlowThread);
</del><ins>+    // We have to ask for our containing flow thread as it may be above the removed sub-tree.
+    RenderFlowThread* flowThreadContainingBlock = this-&gt;flowThreadContainingBlock();
+    if (flowThreadContainingBlock)
+        flowThreadContainingBlock-&gt;removeFlowChildInfo(this);
+    if (is&lt;RenderBlock&gt;(*this))
+        downcast&lt;RenderBlock&gt;(*this).setCachedFlowThreadContainingBlockNeedsUpdate();
+    if (shouldUpdateState)
+        setFlowThreadState(NotInsideFlowThread);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void RenderObject::invalidateFlowThreadContainingBlockIncludingDescendants(RenderFlowThread* flowThread)
+{
+    if (flowThreadState() == NotInsideFlowThread)
+        return;
+
+    if (is&lt;RenderBlock&gt;(*this)) {
+        RenderBlock&amp; block = downcast&lt;RenderBlock&gt;(*this);
+
+        if (block.cachedFlowThreadContainingBlockNeedsUpdate())
+            return;
+
+        flowThread = block.cachedFlowThreadContainingBlock();
+        block.setCachedFlowThreadContainingBlockNeedsUpdate();
+    }
+
+    if (flowThread)
+        flowThread-&gt;removeFlowChildInfo(this);
+
+    for (RenderObject* child = firstChildSlow(); child; child = child-&gt;nextSibling())
+        child-&gt;invalidateFlowThreadContainingBlockIncludingDescendants(flowThread);
+}
+
</ins><span class="cx"> void RenderObject::destroyAndCleanupAnonymousWrappers()
</span><span class="cx"> {
</span><span class="cx">     // If the tree is destroyed, there is no need for a clean-up phase.
</span><span class="lines">@@ -2597,24 +2584,24 @@
</span><span class="cx"> 
</span><span class="cx"> RenderNamedFlowFragment* RenderObject::currentRenderNamedFlowFragment() const
</span><span class="cx"> {
</span><del>-    if (flowThreadState() == NotInsideFlowThread)
</del><ins>+    RenderFlowThread* flowThread = flowThreadContainingBlock();
+    if (!flowThread || !flowThread-&gt;isRenderNamedFlowThread())
</ins><span class="cx">         return nullptr;
</span><span class="cx"> 
</span><del>-    RenderFlowThread* flowThread = view().flowThreadController().currentRenderFlowThread();
-    if (!flowThread)
-        return nullptr;
-
-    ASSERT(flowThread == flowThreadContainingBlock());
-
</del><span class="cx">     // FIXME: Once regions are fully integrated with the compositing system we should uncomment this assert.
</span><span class="cx">     // This assert needs to be disabled because it's possible to ask for the ancestor clipping rectangle of
</span><span class="cx">     // a layer without knowing the containing region in advance.
</span><span class="cx">     // ASSERT(flowThread-&gt;currentRegion() &amp;&amp; flowThread-&gt;currentRegion()-&gt;isRenderNamedFlowFragment());
</span><span class="cx"> 
</span><del>-    RenderNamedFlowFragment* namedFlowFragment = toRenderNamedFlowFragment(flowThread-&gt;currentRegion());
-    return namedFlowFragment;
</del><ins>+    return toRenderNamedFlowFragment(flowThread-&gt;currentRegion());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><ins>+RenderFlowThread* RenderObject::locateFlowThreadContainingBlock() const
+{
+    RenderBlock* containingBlock = this-&gt;containingBlock();
+    return containingBlock ? containingBlock-&gt;flowThreadContainingBlock() : nullptr;
+}
+
</ins><span class="cx"> } // namespace WebCore
</span><span class="cx"> 
</span><span class="cx"> #ifndef NDEBUG
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderObject.h (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderObject.h        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/rendering/RenderObject.h        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -212,18 +212,14 @@
</span><span class="cx"> 
</span><span class="cx">     bool fixedPositionedWithNamedFlowContainingBlock() const;
</span><span class="cx"> 
</span><del>-    enum ShouldUseFlowThreadCache {
-        UseFlowThreadCache,
-        SkipFlowThreadCache
-    };
-
</del><span class="cx">     // Function to return our enclosing flow thread if we are contained inside one. This
</span><span class="cx">     // function follows the containing block chain.
</span><del>-    RenderFlowThread* flowThreadContainingBlock(ShouldUseFlowThreadCache useCache = UseFlowThreadCache) const
</del><ins>+    RenderFlowThread* flowThreadContainingBlock() const
</ins><span class="cx">     {
</span><span class="cx">         if (flowThreadState() == NotInsideFlowThread)
</span><del>-            return 0;
-        return (useCache == SkipFlowThreadCache) ? locateFlowThreadContainingBlockNoCache() : locateFlowThreadContainingBlock();
</del><ins>+            return nullptr;
+
+        return locateFlowThreadContainingBlock();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     RenderNamedFlowFragment* currentRenderNamedFlowFragment() const;
</span><span class="lines">@@ -892,12 +888,12 @@
</span><span class="cx">     void setPosChildNeedsLayoutBit(bool b) { m_bitfields.setPosChildNeedsLayout(b); }
</span><span class="cx">     void setNeedsSimplifiedNormalFlowLayoutBit(bool b) { m_bitfields.setNeedsSimplifiedNormalFlowLayout(b); }
</span><span class="cx"> 
</span><ins>+    virtual RenderFlowThread* locateFlowThreadContainingBlock() const;
+    void invalidateFlowThreadContainingBlockIncludingDescendants(RenderFlowThread* = nullptr);
+
</ins><span class="cx"> private:
</span><del>-    RenderFlowThread* locateFlowThreadContainingBlock() const;
-    RenderFlowThread* locateFlowThreadContainingBlockNoCache() const;
-    
</del><span class="cx">     void removeFromRenderFlowThread();
</span><del>-    void removeFromRenderFlowThreadRecursive(RenderFlowThread*);
</del><ins>+    void removeFromRenderFlowThreadIncludingDescendants(bool);
</ins><span class="cx"> 
</span><span class="cx">     Color selectionColor(int colorProperty) const;
</span><span class="cx">     PassRefPtr&lt;RenderStyle&gt; selectionPseudoStyle() const;
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderRegioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderRegion.cpp (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderRegion.cpp        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/rendering/RenderRegion.cpp        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -218,15 +218,8 @@
</span><span class="cx"> void RenderRegion::computeOverflowFromFlowThread()
</span><span class="cx"> {
</span><span class="cx">     ASSERT(isValid());
</span><del>-    
-    LayoutRect layoutRect;
-    {
-        // When getting the overflow from the flow thread we need to temporarly reset the current flow thread because
-        // we're changing flows.
-        CurrentRenderFlowThreadMaintainer flowThreadMaintainer(m_flowThread);
-        layoutRect = layoutOverflowRectForBox(m_flowThread);
-    }
</del><span class="cx"> 
</span><ins>+    LayoutRect layoutRect = layoutOverflowRectForBox(m_flowThread);
</ins><span class="cx">     layoutRect.setLocation(contentBoxRect().location() + (layoutRect.location() - m_flowThreadPortionRect.location()));
</span><span class="cx"> 
</span><span class="cx">     // FIXME: Correctly adjust the layout overflow for writing modes.
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderViewcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderView.cpp (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderView.cpp        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/rendering/RenderView.cpp        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -1311,10 +1311,12 @@
</span><span class="cx">     if (!m_flowThreadController)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    RenderFlowThread* currentFlowThread = m_flowThreadController-&gt;currentRenderFlowThread();
</del><ins>+    RenderFlowThread* currentFlowThread = object.flowThreadContainingBlock();
</ins><span class="cx">     if (!currentFlowThread)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><ins>+    m_layoutState-&gt;setCurrentRenderFlowThread(currentFlowThread);
+
</ins><span class="cx">     currentFlowThread-&gt;pushFlowThreadLayoutState(object);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1323,7 +1325,7 @@
</span><span class="cx">     if (!m_flowThreadController)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    RenderFlowThread* currentFlowThread = m_flowThreadController-&gt;currentRenderFlowThread();
</del><ins>+    RenderFlowThread* currentFlowThread = m_layoutState-&gt;currentRenderFlowThread();
</ins><span class="cx">     if (!currentFlowThread)
</span><span class="cx">         return;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorerenderingRenderViewh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/rendering/RenderView.h (174760 => 174761)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/rendering/RenderView.h        2014-10-16 06:45:53 UTC (rev 174760)
+++ trunk/Source/WebCore/rendering/RenderView.h        2014-10-16 06:50:30 UTC (rev 174761)
</span><span class="lines">@@ -295,7 +295,7 @@
</span><span class="cx"> 
</span><span class="cx">     void pushLayoutStateForCurrentFlowThread(const RenderObject&amp;);
</span><span class="cx">     void popLayoutStateForCurrentFlowThread();
</span><del>-    
</del><ins>+
</ins><span class="cx">     friend class LayoutStateMaintainer;
</span><span class="cx">     friend class LayoutStateDisabler;
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>