Do not remove floating legend from inner block as it gets destroyed somewhere else.

third_party/WebKit/Source/core/layout/LayoutFieldset.cpp

Index: third_party/WebKit/Source/core/layout/LayoutFieldset.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutFieldset.cpp b/third_party/WebKit/Source/core/layout/LayoutFieldset.cpp
index f0eb1cb0bb31fa10c48ff27296ab5c51a2b96c4b..7db29de18bfcd0395624779ddd1c730a7334a4a0 100644
--- a/third_party/WebKit/Source/core/layout/LayoutFieldset.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutFieldset.cpp
@@ -260,17 +260,16 @@ void LayoutFieldset::addChild(LayoutObject* newChild,
     createInnerBlock();
 
   if (isHTMLLegendElement(newChild->node())) {
-    // Let legend block to be the 2nd for correct layout positioning.
-    newChild->mutableStyle()->setOrder(2);
-
-    // LayoutFlexibleBox::addChild will create an anonymous block if legend is
-    // float. Use the existing fieldset's anonymous block here instead.
+    // Flexbox forces the floating legend to be non-floating => add the floating
+    // legend to the inner block.
     if (newChild->isFloatingOrOutOfFlowPositioned()) {
-      m_innerBlock->addChild(newChild);
+      // Always add the legend first, i.e. before m_innerBlock->firstChild()
+      m_innerBlock->addChild(newChild, m_innerBlock->firstChild());
     } else {
+      // Let legend block to be the 2nd for correct layout positioning.
+      newChild->mutableStyle()->setOrder(2);
       LayoutFlexibleBox::addChild(newChild, m_innerBlock);
     }
-
   } else {
     if (beforeChild && isHTMLLegendElement(beforeChild->node())) {
       m_innerBlock->addChild(newChild);
@@ -292,18 +291,17 @@ void LayoutFieldset::createInnerBlock() {
 }
 
 void LayoutFieldset::removeChild(LayoutObject* oldChild) {
-  if (isHTMLLegendElement(oldChild->node())) {
-    if (oldChild->isFloatingOrOutOfFlowPositioned()) {
-      m_innerBlock->removeChild(oldChild);
-    } else {
-      LayoutFlexibleBox::removeChild(oldChild);
-      if (m_innerBlock) {
-        resetInnerBlockPadding(isHorizontalWritingMode(), m_innerBlock);
-        m_innerBlock->setNeedsLayout(LayoutInvalidationReason::FieldsetChanged,
-                                     MarkOnlyThis);
-      }
+  // Out flow positioned elements are wrapped into an anonymous

[cbiesinger, 2016/12/05 21:41:26]

Out flow -> Out of flow

[Gleb Lanbin, 2016/12/06 00:03:28]

Done.

+  // block(see LayoutBlock::addChild) and then gets destroyed in
+  // LayoutObject::destroyAndCleanupAnonymousWrappers.
+  if (isHTMLLegendElement(oldChild->node()) &&
+      !oldChild->isFloatingOrOutOfFlowPositioned()) {
+    LayoutFlexibleBox::removeChild(oldChild);
+    if (m_innerBlock) {
+      resetInnerBlockPadding(isHorizontalWritingMode(), m_innerBlock);
+      m_innerBlock->setNeedsLayout(LayoutInvalidationReason::FieldsetChanged,
+                                   MarkOnlyThis);
     }
-
     setShouldDoFullPaintInvalidation();
   } else if (oldChild == m_innerBlock) {
     LayoutFlexibleBox::removeChild(oldChild);