Maybe that sounds obvious, and like something we get for free (we lay
out in tree order, after all).

However:

This is not the case for OOFs inside a fragmentation context. Such OOFs
become direct children of fragmentainers. The way it works is that we go
through all OOFs that have bubbled up to the fragmentation context root
during in-flow layout, and then figure out in which fragmentainer they
all start, by calculating their offset. Then, when that job is done, we
lay them out, fragmentainer by fragmentainer, and then mutate the
fragments to include the OOFs, and propagate anchors.

But a subsequent OOF may refer to an anchor in a preceding OOF, so we
need to have those anchors propagated before laying out any subsequent
OOF.

There was code that made sure that we laid out in containing block
order, which handled many of the issues, but not if the OOF with an
anchor and the OOF referring to said anchor lived in the same containing
block.

This fixes that.

Convert the tests for this to reftests, since offsetLeft & co (used by
check-layout-th.js) have poor interop inside multicol.
See w3c/csswg-drafts#11541

Bug: 405840229
Change-Id: Id9bece2af08c9c51af50b06dabd47359fcf477ae
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6895236
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Reviewed-by: Ian Kilpatrick <ikilpatrick@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1507855}