Detect floats to avoid or clear due to negative margin top

third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp

Index: third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
index dd29fed7bae60dbf585a4a6250e217eff5ff7fa2..b82580923a4d97eb71c95b9c80834c131fd0b734 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
@@ -1721,10 +1721,10 @@ LayoutUnit LayoutBlockFlow::collapseMargins(LayoutBox& child,
 
   LayoutObject* prev = child.previousSibling();
   LayoutBlockFlow* previousBlockFlow =
-      prev && prev->isLayoutBlockFlow() &&
-              !prev->isFloatingOrOutOfFlowPositioned()
-          ? toLayoutBlockFlow(prev)
-          : 0;
+      prev && prev->isLayoutBlockFlow() ? toLayoutBlockFlow(prev) : nullptr;
+  bool previousBlockFlowCanSelfCollapse =
+      previousBlockFlow &&
+      !previousBlockFlow->isFloatingOrOutOfFlowPositioned();
   // If the child's previous sibling is a self-collapsing block that cleared a
   // float then its top border edge has been set at the bottom border edge of
   // the float. Since we want to collapse the child's top margin with the self-
@@ -1732,7 +1732,8 @@ LayoutUnit LayoutBlockFlow::collapseMargins(LayoutBox& child,
   // height to match the margin top of the self-collapsing block. If the
   // resulting collapsed margin leaves the child still intruding into the float
   // then we will want to clear it.
-  if (!marginInfo.canCollapseWithMarginBefore() && previousBlockFlow &&
+  if (!marginInfo.canCollapseWithMarginBefore() &&
+      previousBlockFlowCanSelfCollapse &&
       marginInfo.lastChildIsSelfCollapsingBlockWithClearance())
     setLogicalHeight(
         logicalHeight() -
@@ -1816,18 +1817,24 @@ LayoutUnit LayoutBlockFlow::collapseMargins(LayoutBox& child,
     setLogicalHeight(logicalHeight() + (logicalTop - oldLogicalTop));
   }
 
-  if (previousBlockFlow) {
-    // If |child| is a self-collapsing block it may have collapsed into a
-    // previous sibling and although it hasn't reduced the height of the parent
-    // yet any floats from the parent will now overhang.
-    LayoutUnit oldLogicalHeight = logicalHeight();
-    setLogicalHeight(logicalTop);
-    if (!previousBlockFlow->avoidsFloats() &&
-        (previousBlockFlow->logicalTop() +
-         previousBlockFlow->lowestFloatLogicalBottom()) > logicalTop)
+  // If |child| has moved up into previous siblings it needs to avoid or clear
+  // any floats they contain.
+  LayoutUnit oldLogicalHeight = logicalHeight();
+  setLogicalHeight(logicalTop);
+  while (previousBlockFlow) {
+    auto lowestFloat = previousBlockFlow->logicalTop() +
+                       previousBlockFlow->lowestFloatLogicalBottom();
+    if (lowestFloat > logicalTop)
       addOverhangingFloats(previousBlockFlow, false);
-    setLogicalHeight(oldLogicalHeight);
+    LayoutObject* prev = previousBlockFlow->previousSibling();
+    if (prev && prev->isLayoutBlockFlow())
+      previousBlockFlow = toLayoutBlockFlow(prev);
+    else
+      previousBlockFlow = nullptr;
+  }
+  setLogicalHeight(oldLogicalHeight);
 
+  if (previousBlockFlowCanSelfCollapse) {
     // If |child|'s previous sibling is or contains a self-collapsing block that
     // cleared a float and margin collapsing resulted in |child| moving up
     // into the margin area of the self-collapsing block then the float it