Floating legend should be added to the fieldset's anonymous block.

third_party/WebKit/Source/core/layout/LayoutFieldset.cpp

Index: third_party/WebKit/Source/core/layout/LayoutFieldset.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutFieldset.cpp b/third_party/WebKit/Source/core/layout/LayoutFieldset.cpp
index 1527da1bdd632aaf0803296b2e45862baf241dfd..f0eb1cb0bb31fa10c48ff27296ab5c51a2b96c4b 100644
--- a/third_party/WebKit/Source/core/layout/LayoutFieldset.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutFieldset.cpp
@@ -262,7 +262,15 @@ void LayoutFieldset::addChild(LayoutObject* newChild,
   if (isHTMLLegendElement(newChild->node())) {
     // Let legend block to be the 2nd for correct layout positioning.
     newChild->mutableStyle()->setOrder(2);
-    LayoutFlexibleBox::addChild(newChild, m_innerBlock);
+
+    // LayoutFlexibleBox::addChild will create an anonymous block if legend is
+    // float. Use the existing fieldset's anonymous block here instead.
+    if (newChild->isFloatingOrOutOfFlowPositioned()) {
+      m_innerBlock->addChild(newChild);
+    } else {
+      LayoutFlexibleBox::addChild(newChild, m_innerBlock);
+    }
+
   } else {
     if (beforeChild && isHTMLLegendElement(beforeChild->node())) {
       m_innerBlock->addChild(newChild);
@@ -285,12 +293,17 @@ void LayoutFieldset::createInnerBlock() {
 
 void LayoutFieldset::removeChild(LayoutObject* oldChild) {
   if (isHTMLLegendElement(oldChild->node())) {
-    LayoutFlexibleBox::removeChild(oldChild);
-    if (m_innerBlock) {
-      resetInnerBlockPadding(isHorizontalWritingMode(), m_innerBlock);
-      m_innerBlock->setNeedsLayout(LayoutInvalidationReason::FieldsetChanged,
-                                   MarkOnlyThis);
+    if (oldChild->isFloatingOrOutOfFlowPositioned()) {
+      m_innerBlock->removeChild(oldChild);
+    } else {
+      LayoutFlexibleBox::removeChild(oldChild);
+      if (m_innerBlock) {
+        resetInnerBlockPadding(isHorizontalWritingMode(), m_innerBlock);
+        m_innerBlock->setNeedsLayout(LayoutInvalidationReason::FieldsetChanged,
+                                     MarkOnlyThis);
+      }
     }
+
     setShouldDoFullPaintInvalidation();
   } else if (oldChild == m_innerBlock) {
     LayoutFlexibleBox::removeChild(oldChild);