Let positionNewFloats() take a logicalTop parameter.

third_party/WebKit/Source/core/layout/line/BreakingContextInlineHeaders.h

 /*
  * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2003, 2004, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc.
  *               All right reserved.
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 478 matching lines @@
   LineLayoutBox floatBox(m_current.getLineLayoutItem());
   FloatingObject* floatingObject = m_block.insertFloatingObject(floatBox);
   // Check if it fits in the current line; if it does, position it now,
   // otherwise, position it after moving to next line (in newLine() func).
   // FIXME: Bug 110372: Properly position multiple stacked floats with
   // non-rectangular shape outside.
   if (m_floatsFitOnLine &&
       m_width.fitsOnLine(
           m_block.logicalWidthForFloat(*floatingObject).toFloat(),
           ExcludeWhitespace)) {
-    m_block.positionNewFloats(&m_width);
+    m_block.positionNewFloats(m_block.logicalHeight(), &m_width);
     if (m_lineBreak.getLineLayoutItem() == m_current.getLineLayoutItem()) {
       ASSERT(!m_lineBreak.offset());
       m_lineBreak.increment();
     }
   } else {
     m_floatsFitOnLine = false;
   }
   // Update prior line break context characters, using U+FFFD (OBJECT
   // REPLACEMENT CHARACTER) for floating element.
   m_layoutTextInfo.m_lineBreakIterator.updatePriorContext(replacementCharacter);
@@ skipping 981 matching lines @@
 
   if (style.getTextIndentType() == TextIndentHanging)
     indentText = indentText == IndentText ? DoNotIndentText : IndentText;
 
   return indentText;
 }
 
 }  // namespace blink
 
 #endif  // BreakingContextInlineHeaders_h