Old lines may be detached / extracted during layout.

third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp b/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
index ec62c97eecfe87692ead5f08ab49bd496f63c7ef..24d2466ca0ff876224c452fb842fc96a4918dd6f 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
@@ -1825,7 +1825,11 @@ bool LayoutBlockFlow::checkPaginationAndFloatsAtEndLine(LineLayoutState& layoutS
     // See if any floats end in the range along which we want to shift the lines vertically.
     LayoutUnit logicalTop = std::min(logicalHeight(), layoutState.endLineLogicalTop());
 
-    LayoutUnit logicalBottom = lastRootBox()->lineBottomWithLeading() + absoluteValue(lineDelta);
+    RootInlineBox* lastLine = layoutState.endLine();
+    while (RootInlineBox* nextLine = lastLine->nextRootBox())
+        lastLine = nextLine;
+
+    LayoutUnit logicalBottom = lastLine->lineBottomWithLeading() + absoluteValue(lineDelta);
 
     const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
     FloatingObjectSetIterator end = floatingObjectSet.end();