Descend into node with overflow and floating content

third_party/WebKit/Source/core/layout/ScrollAnchor.cpp

Index: third_party/WebKit/Source/core/layout/ScrollAnchor.cpp
diff --git a/third_party/WebKit/Source/core/layout/ScrollAnchor.cpp b/third_party/WebKit/Source/core/layout/ScrollAnchor.cpp
index 54a0ed6038e088ab2d9485421ceac7a778233693..566951ee6049eab0999e8050c0934a24939ad20a 100644
--- a/third_party/WebKit/Source/core/layout/ScrollAnchor.cpp
+++ b/third_party/WebKit/Source/core/layout/ScrollAnchor.cpp
@@ -73,6 +73,14 @@ static LayoutRect relativeBounds(const LayoutObject* layoutObject, const Scrolla
     LayoutRect localBounds;
     if (layoutObject->isBox()) {
         localBounds = toLayoutBox(layoutObject)->borderBoxRect();
+        // borderBoxRect doesn't include overflow content and floats.
+        LayoutUnit maxHeight = std::max(localBounds.height(), toLayoutBox(layoutObject)->layoutOverflowRect().height());
+        if (layoutObject->isLayoutBlockFlow() && toLayoutBlockFlow(layoutObject)->containsFloats()) {
+            // Note that lowestFloatLogicalBottom doesn't include floating
+            // grandchildren.
+            maxHeight = std::max(maxHeight, toLayoutBlockFlow(layoutObject)->lowestFloatLogicalBottom());
+        }
+        localBounds.setHeight(maxHeight);
     } else if (layoutObject->isText()) {
         // TODO(skobes): Use first and last InlineTextBox only?
         for (InlineTextBox* box = toLayoutText(layoutObject)->firstTextBox(); box; box = box->nextTextBox())