Do not remove floating legend from inner block as it gets destroyed somewhere else.

third_party/WebKit/Source/core/layout/LayoutFieldset.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 242 matching lines @@
   // Let anonymous block to be the 1st for correct layout positioning.
   childStyle.setOrder(1);
 }
 
 void LayoutFieldset::addChild(LayoutObject* newChild,
                               LayoutObject* beforeChild) {
   if (!m_innerBlock)
     createInnerBlock();
 
   if (isHTMLLegendElement(newChild->node())) {
-    // Let legend block to be the 2nd for correct layout positioning.
-    newChild->mutableStyle()->setOrder(2);
-
-    // LayoutFlexibleBox::addChild will create an anonymous block if legend is
-    // float. Use the existing fieldset's anonymous block here instead.
+    // Flexbox forces the floating legend to be non-floating => add the floating
+    // legend to the inner block.
     if (newChild->isFloatingOrOutOfFlowPositioned()) {
-      m_innerBlock->addChild(newChild);
+      // Always add the legend first, i.e. before m_innerBlock->firstChild()
+      m_innerBlock->addChild(newChild, m_innerBlock->firstChild());
     } else {
+      // Let legend block to be the 2nd for correct layout positioning.
+      newChild->mutableStyle()->setOrder(2);
       LayoutFlexibleBox::addChild(newChild, m_innerBlock);
     }
-
   } else {
     if (beforeChild && isHTMLLegendElement(beforeChild->node())) {
       m_innerBlock->addChild(newChild);
     } else {
       m_innerBlock->addChild(newChild, beforeChild);
     }
     if (AXObjectCache* cache = document().existingAXObjectCache())
       cache->childrenChanged(this);
   }
 }
 
 void LayoutFieldset::createInnerBlock() {
   if (m_innerBlock) {
     DCHECK(firstChild() == m_innerBlock);
     return;
   }
   m_innerBlock = createAnonymousBlock(style()->display());
   LayoutFlexibleBox::addChild(m_innerBlock);
 }
 
 void LayoutFieldset::removeChild(LayoutObject* oldChild) {
-  if (isHTMLLegendElement(oldChild->node())) {
-    if (oldChild->isFloatingOrOutOfFlowPositioned()) {
-      m_innerBlock->removeChild(oldChild);
-    } else {
-      LayoutFlexibleBox::removeChild(oldChild);
-      if (m_innerBlock) {
-        resetInnerBlockPadding(isHorizontalWritingMode(), m_innerBlock);
-        m_innerBlock->setNeedsLayout(LayoutInvalidationReason::FieldsetChanged,
-                                     MarkOnlyThis);
-      }
+  // Out flow positioned elements are wrapped into an anonymous

[cbiesinger, 2016/12/05 21:41:26]

Out flow -> Out of flow

[Gleb Lanbin, 2016/12/06 00:03:28]

Done.

+  // block(see LayoutBlock::addChild) and then gets destroyed in
+  // LayoutObject::destroyAndCleanupAnonymousWrappers.
+  if (isHTMLLegendElement(oldChild->node()) &&
+      !oldChild->isFloatingOrOutOfFlowPositioned()) {
+    LayoutFlexibleBox::removeChild(oldChild);
+    if (m_innerBlock) {
+      resetInnerBlockPadding(isHorizontalWritingMode(), m_innerBlock);
+      m_innerBlock->setNeedsLayout(LayoutInvalidationReason::FieldsetChanged,
+                                   MarkOnlyThis);
     }
-
     setShouldDoFullPaintInvalidation();
   } else if (oldChild == m_innerBlock) {
     LayoutFlexibleBox::removeChild(oldChild);
     m_innerBlock = nullptr;
   } else if (oldChild->parent() == this) {
     LayoutFlexibleBox::removeChild(oldChild);
   } else if (m_innerBlock) {
     m_innerBlock->removeChild(oldChild);
   }
 }
 
 }  // namespace blink