Fix treatment of layout overflow rect in ScrollAnchor bounds computation.

third_party/WebKit/Source/core/layout/ScrollAnchor.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/ScrollAnchor.h"
 
 #include "core/frame/FrameView.h"
 #include "core/frame/UseCounter.h"
 #include "core/layout/LayoutBlockFlow.h"
 #include "core/layout/api/LayoutBoxItem.h"
@@ skipping 58 matching lines @@
 }
 
 // Bounds of the LayoutObject relative to the scroller's visible content rect.
 static LayoutRect relativeBounds(const LayoutObject* layoutObject,
                                  const ScrollableArea* scroller) {
   LayoutRect localBounds;
   if (layoutObject->isBox()) {
     localBounds = toLayoutBox(layoutObject)->borderBoxRect();
     if (!layoutObject->hasOverflowClip()) {
       // borderBoxRect doesn't include overflow content and floats.
-      LayoutUnit maxHeight =
-          std::max(localBounds.height(),
-                   toLayoutBox(layoutObject)->layoutOverflowRect().height());
+      LayoutUnit maxY =
+          std::max(localBounds.maxY(),
+                   toLayoutBox(layoutObject)->layoutOverflowRect().maxY());
       if (layoutObject->isLayoutBlockFlow() &&
           toLayoutBlockFlow(layoutObject)->containsFloats()) {
         // Note that lowestFloatLogicalBottom doesn't include floating
         // grandchildren.
-        maxHeight = std::max(
-            maxHeight,
-            toLayoutBlockFlow(layoutObject)->lowestFloatLogicalBottom());
+        maxY = std::max(
+            maxY, toLayoutBlockFlow(layoutObject)->lowestFloatLogicalBottom());
       }
-      localBounds.setHeight(maxHeight);
+      localBounds.shiftMaxYEdgeTo(maxY);
     }
   } else if (layoutObject->isText()) {
     // TODO(skobes): Use first and last InlineTextBox only?
     for (InlineTextBox* box = toLayoutText(layoutObject)->firstTextBox(); box;
          box = box->nextTextBox())
       localBounds.unite(box->frameRect());
   } else {
     // Only LayoutBox and LayoutText are supported.
     ASSERT_NOT_REACHED();
   }
@@ skipping 229 matching lines @@
 bool ScrollAnchor::refersTo(const LayoutObject* layoutObject) const {
   return m_anchorObject == layoutObject;
 }
 
 void ScrollAnchor::notifyRemoved(LayoutObject* layoutObject) {
   if (m_anchorObject == layoutObject)
     clearSelf();
 }
 
 }  // namespace blink