logicalHeightWithVisibleOverflow() needs to include overhanging floats.

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 3887 matching lines @@
 
 LayoutUnit LayoutBlockFlow::nextFloatLogicalBottomBelowForBlock(
     LayoutUnit logicalHeight) const {
   if (!m_floatingObjects)
     return logicalHeight;
 
   return m_floatingObjects->findNextFloatLogicalBottomBelowForBlock(
       logicalHeight);
 }
 
+LayoutUnit LayoutBlockFlow::logicalHeightWithVisibleOverflow() const {
+  LayoutUnit logicalHeight = LayoutBlock::logicalHeightWithVisibleOverflow();
+  return std::max(logicalHeight, lowestFloatLogicalBottom());
+}
+
 Node* LayoutBlockFlow::nodeForHitTest() const {
   // If we are in the margins of block elements that are part of a
   // continuation we're actually still inside the enclosing element
   // that was split. Use the appropriate inner node.
   return isAnonymousBlockContinuation() ? continuation()->node() : node();
 }
 
 bool LayoutBlockFlow::hitTestChildren(
     HitTestResult& result,
     const HitTestLocation& locationInContainer,
@@ skipping 632 matching lines @@
   return LayoutBlock::invalidatePaintIfNeeded(paintInvalidationState);
 }
 
 void LayoutBlockFlow::invalidateDisplayItemClients(
     PaintInvalidationReason invalidationReason) const {
   BlockFlowPaintInvalidator(*this).invalidateDisplayItemClients(
       invalidationReason);
 }
 
 }  // namespace blink