KEYGEN elements should always create LayoutBlockFlow, regardless of display type.

Source/core/html/HTMLKeygenElement.cpp

Index: Source/core/html/HTMLKeygenElement.cpp
diff --git a/Source/core/html/HTMLKeygenElement.cpp b/Source/core/html/HTMLKeygenElement.cpp
index fd60c60163468de51563628f59f9cebe114b1bbb..78708f518ebe15a188d1a340bb3e22e6070d2c9a 100644
--- a/Source/core/html/HTMLKeygenElement.cpp
+++ b/Source/core/html/HTMLKeygenElement.cpp
@@ -33,6 +33,7 @@
 #include "core/html/FormDataList.h"
 #include "core/html/HTMLOptionElement.h"
 #include "core/html/HTMLSelectElement.h"
+#include "core/layout/LayoutBlockFlow.h"
 #include "platform/text/PlatformLocale.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebLocalizedString.h"
@@ -56,6 +57,14 @@ PassRefPtrWillBeRawPtr<HTMLKeygenElement> HTMLKeygenElement::create(Document& do
     return keygen.release();
 }
 
+LayoutObject* HTMLKeygenElement::createLayoutObject(const LayoutStyle& style)
+{
+    // TODO(mstensho): While it's harmful and meaningless to allow most display types on replaced
+    // content (e.g. table, table-row or flex), it would be useful to honor at least some of
+    // them. Table-cell (and maybe table-caption too), for instance. See crbug.com/335040
+    return new LayoutBlockFlow(this);
+}
+
 void HTMLKeygenElement::didAddClosedShadowRoot(ShadowRoot& root)
 {
     DEFINE_STATIC_LOCAL(AtomicString, keygenSelectPseudoId, ("-webkit-keygen-select", AtomicString::ConstructFromLiteral));