[Backport] Flowthread should move its floatlists to container when evacuating

This ensures that if any of the floats gets deleted the new
container will be able to delete from its new descendants'
float-lists.

BUG=714440

Change-Id: I4936d93c27d6cb93ec641638674ab4ab6c0802ac
Review-Url: https://codereview.chromium.org/2863093004
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

2 files changed, 2 insertions, 2 deletions

diff --git a/chromium/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp b/chromium/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
index 72377a66916..ed6d374cc6b 100644
--- a/chromium/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
+++ b/chromium/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
@@ -1992,7 +1992,6 @@ void LayoutBlockFlow::addChild(LayoutObject* newChild, LayoutObject* beforeChild
 void LayoutBlockFlow::moveAllChildrenIncludingFloatsTo(LayoutBlock* toBlock, bool fullRemoveInsert)
 {
     LayoutBlockFlow* toBlockFlow = toLayoutBlockFlow(toBlock);
-    moveAllChildrenTo(toBlockFlow, fullRemoveInsert);
 
     // When a portion of the layout tree is being detached, anonymous blocks
     // will be combined as their children are deleted. In this process, the
@@ -2028,6 +2027,7 @@ void LayoutBlockFlow::moveAllChildrenIncludingFloatsTo(LayoutBlock* toBlock, boo
             toBlockFlow->m_floatingObjects->add(floatingObject.unsafeClone());
         }
     }
+    moveAllChildrenTo(toBlockFlow, fullRemoveInsert);
 
 }
 
diff --git a/chromium/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp b/chromium/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp
index 7a4e583df7a..173dd420051 100644
--- a/chromium/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp
+++ b/chromium/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp
@@ -253,7 +253,7 @@ void LayoutMultiColumnFlowThread::evacuateAndDestroy()
     // container, we need to unregister the flow thread, so that they aren't just re-added again to
     // the flow thread that we're trying to empty.
     multicolContainer->resetMultiColumnFlowThread();
-    moveAllChildrenTo(multicolContainer, true);
+    moveAllChildrenIncludingFloatsTo(multicolContainer, true);
 
     // We used to manually nuke the line box tree here, but that should happen automatically when
     // moving children around (the code above).