Dirty lineboxes when adding floats to a nested empty inline

third_party/WebKit/Source/core/layout/line/LineBoxList.cpp

Index: third_party/WebKit/Source/core/layout/line/LineBoxList.cpp
diff --git a/third_party/WebKit/Source/core/layout/line/LineBoxList.cpp b/third_party/WebKit/Source/core/layout/line/LineBoxList.cpp
index f63948a40d51aebba58657fbf6155f21bd87c46f..7938afb2dd6040150e4b243f33613013fa9d8203 100644
--- a/third_party/WebKit/Source/core/layout/line/LineBoxList.cpp
+++ b/third_party/WebKit/Source/core/layout/line/LineBoxList.cpp
@@ -291,11 +291,15 @@ void LineBoxList::dirtyLinesFromChangedChild(LineLayoutItem container,
   // check the siblings of our inline parent. If we didn't find a line box, then
   // use our parent's first line box.
   RootInlineBox* box = nullptr;
-  LineLayoutItem curr = child.isFloating() && !child.previousSibling() &&
-                                child.parent() &&
-                                child.parent().isLayoutInline()
-                            ? child.parent().previousSibling()
-                            : child.previousSibling();
+  LineLayoutItem curr = child.previousSibling();
+  if (child.isFloating() && !curr) {
+    LineLayoutItem parent = child.parent();
+    while (parent && parent.isLayoutInline() && !parent.previousSibling())
+      parent = parent.parent();
+    if (parent)
+      curr = parent.previousSibling();
+  }
+
   for (; curr; curr = curr.previousSibling()) {
     if (curr.isFloatingOrOutOfFlowPositioned())
       continue;