Dirty lineboxes when adding a float to an empty inline

third_party/WebKit/Source/core/layout/line/LineBoxList.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 269 matching lines @@
         canDirtyAncestors) {
       container.parent().dirtyLinesFromChangedChild(container);
       // Mark the container to avoid dirtying the same lines again across
       // multiple destroy() calls of the same subtree.
       container.setAncestorLineBoxDirty();
     }
     return;
   }
 
   // Try to figure out which line box we belong in. First try to find a previous
-  // line box by examining our siblings. If we didn't find a line box, then use
-  // our parent's first line box.
+  // line box by examining our siblings. If we are a float inside an inline then
+  // check the siblings of our inline parent. If we didn't find a line box, then
+  // use our parent's first line box.
   RootInlineBox* box = nullptr;
-  LineLayoutItem curr = nullptr;
-  for (curr = child.previousSibling(); curr; curr = curr.previousSibling()) {
+  LineLayoutItem curr = child.isFloating() && !child.previousSibling() &&
+                                child.parent() &&
+                                child.parent().isLayoutInline()
+                            ? child.parent().previousSibling()
+                            : child.previousSibling();
+  for (; curr; curr = curr.previousSibling()) {
     if (curr.isFloatingOrOutOfFlowPositioned())
       continue;
 
     if (curr.isAtomicInlineLevel()) {
       InlineBox* wrapper = LineLayoutBox(curr).inlineBoxWrapper();
       if (wrapper)
         box = &wrapper->root();
     } else if (curr.isText()) {
       InlineTextBox* textBox = LineLayoutText(curr).lastTextBox();
       if (textBox)
@@ skipping 59 matching lines @@
     ASSERT(child->prevLineBox() == prev);
     prev = child;
   }
   ASSERT(prev == m_lastLineBox);
 #endif
 }
 
 #endif
 
 }  // namespace blink