Floating legend should be added to the fieldset's anonymous block.

third_party/WebKit/Source/core/layout/LayoutFieldset.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 244 matching lines @@
 }
 
 void LayoutFieldset::addChild(LayoutObject* newChild,
                               LayoutObject* beforeChild) {
   if (!m_innerBlock)
     createInnerBlock();
 
   if (isHTMLLegendElement(newChild->node())) {
     // Let legend block to be the 2nd for correct layout positioning.
     newChild->mutableStyle()->setOrder(2);
-    LayoutFlexibleBox::addChild(newChild, m_innerBlock);
+
+    // LayoutFlexibleBox::addChild will create an anonymous block if legend is
+    // float. Use the existing fieldset's anonymous block here instead.
+    if (newChild->isFloatingOrOutOfFlowPositioned()) {
+      m_innerBlock->addChild(newChild);
+    } else {
+      LayoutFlexibleBox::addChild(newChild, m_innerBlock);
+    }
+
   } else {
     if (beforeChild && isHTMLLegendElement(beforeChild->node())) {
       m_innerBlock->addChild(newChild);
     } else {
       m_innerBlock->addChild(newChild, beforeChild);
     }
     if (AXObjectCache* cache = document().existingAXObjectCache())
       cache->childrenChanged(this);
   }
 }
 
 void LayoutFieldset::createInnerBlock() {
   if (m_innerBlock) {
     DCHECK(firstChild() == m_innerBlock);
     return;
   }
   m_innerBlock = createAnonymousBlock(style()->display());
   LayoutFlexibleBox::addChild(m_innerBlock);
 }
 
 void LayoutFieldset::removeChild(LayoutObject* oldChild) {
   if (isHTMLLegendElement(oldChild->node())) {
-    LayoutFlexibleBox::removeChild(oldChild);
-    if (m_innerBlock) {
-      resetInnerBlockPadding(isHorizontalWritingMode(), m_innerBlock);
-      m_innerBlock->setNeedsLayout(LayoutInvalidationReason::FieldsetChanged,
-                                   MarkOnlyThis);
+    if (oldChild->isFloatingOrOutOfFlowPositioned()) {
+      m_innerBlock->removeChild(oldChild);
+    } else {
+      LayoutFlexibleBox::removeChild(oldChild);
+      if (m_innerBlock) {
+        resetInnerBlockPadding(isHorizontalWritingMode(), m_innerBlock);
+        m_innerBlock->setNeedsLayout(LayoutInvalidationReason::FieldsetChanged,
+                                     MarkOnlyThis);
+      }
     }
+
     setShouldDoFullPaintInvalidation();
   } else if (oldChild == m_innerBlock) {
     LayoutFlexibleBox::removeChild(oldChild);
     m_innerBlock = nullptr;
   } else if (oldChild->parent() == this) {
     LayoutFlexibleBox::removeChild(oldChild);
   } else if (m_innerBlock) {
     m_innerBlock->removeChild(oldChild);
   }
 }
 
 }  // namespace blink