Descend into node with overflow and floating content

third_party/WebKit/Source/core/layout/ScrollAnchor.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/ScrollAnchor.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/UseCounter.h"
 #include "core/layout/LayoutView.h"
 #include "core/layout/line/InlineTextBox.h"
@@ skipping 55 matching lines @@
     ASSERT_NOT_REACHED();
     return LayoutPoint();
 }
 
 // Bounds of the LayoutObject relative to the scroller's visible content rect.
 static LayoutRect relativeBounds(const LayoutObject* layoutObject, const ScrollableArea* scroller)
 {
     LayoutRect localBounds;
     if (layoutObject->isBox()) {
         localBounds = toLayoutBox(layoutObject)->borderBoxRect();
+        // borderBoxRect doesn't include overflow content and floats.
+        LayoutUnit maxHeight = std::max(localBounds.height(), toLayoutBox(layoutObject)->layoutOverflowRect().height());
+        if (layoutObject->isLayoutBlockFlow() && toLayoutBlockFlow(layoutObject)->containsFloats()) {
+            // Note that lowestFloatLogicalBottom doesn't include floating
+            // grandchildren.
+            maxHeight = std::max(maxHeight, toLayoutBlockFlow(layoutObject)->lowestFloatLogicalBottom());
+        }
+        localBounds.setHeight(maxHeight);
     } else if (layoutObject->isText()) {
         // TODO(skobes): Use first and last InlineTextBox only?
         for (InlineTextBox* box = toLayoutText(layoutObject)->firstTextBox(); box; box = box->nextTextBox())
             localBounds.unite(box->calculateBoundaries());
     } else {
         // Only LayoutBox and LayoutText are supported.
         ASSERT_NOT_REACHED();
     }
     LayoutRect relativeBounds = LayoutRect(layoutObject->localToAncestorQuad(
         FloatRect(localBounds), scrollerLayoutBox(scroller)).boundingBox());
@@ skipping 128 matching lines @@
 void ScrollAnchor::clear()
 {
     LayoutObject* anchorObject = m_anchorObject;
     m_anchorObject = nullptr;
 
     if (anchorObject)
         anchorObject->maybeClearIsScrollAnchorObject();
 }
 
 } // namespace blink