Old lines may be detached / extracted during layout.

third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp

 /*
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2003, 2004, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All right reserved.
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 1807 matching lines @@
             adjustLinePositionForPagination(*lineBox, lineDelta);
             lineBox->setPaginationStrut(oldPaginationStrut);
         }
     }
     if (!lineDelta)
         return true;
 
     // See if any floats end in the range along which we want to shift the lines vertically.
     LayoutUnit logicalTop = std::min(logicalHeight(), layoutState.endLineLogicalTop());
 
-    LayoutUnit logicalBottom = lastRootBox()->lineBottomWithLeading() + absoluteValue(lineDelta);
+    RootInlineBox* lastLine = layoutState.endLine();
+    while (RootInlineBox* nextLine = lastLine->nextRootBox())
+        lastLine = nextLine;
+
+    LayoutUnit logicalBottom = lastLine->lineBottomWithLeading() + absoluteValue(lineDelta);
 
     const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
     FloatingObjectSetIterator end = floatingObjectSet.end();
     for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it) {
         const FloatingObject& floatingObject = *it->get();
         if (logicalBottomForFloat(floatingObject) >= logicalTop && logicalBottomForFloat(floatingObject) < logicalBottom)
             return false;
     }
 
     return true;
@@ skipping 231 matching lines @@
     if (!line || !line->isFirstLineStyle())
         return reason;
     // It's the RootInlineBox that paints the ::first-line background. Note that since it may be
     // expensive to figure out if the first line is affected by any ::first-line selectors at all,
     // we just invalidate it unconditionally, since that's typically cheaper.
     invalidateDisplayItemClient(*line);
     return reason;
 }
 
 } // namespace blink