Fix treatment of layout overflow rect in ScrollAnchor bounds computation.

third_party/WebKit/Source/core/layout/ScrollAnchor.cpp

Index: third_party/WebKit/Source/core/layout/ScrollAnchor.cpp
diff --git a/third_party/WebKit/Source/core/layout/ScrollAnchor.cpp b/third_party/WebKit/Source/core/layout/ScrollAnchor.cpp
index 84badd5c5795f83e255c1b6f76b63f61b0f38687..68b2bb225f5e830dd7e6b97e28d2e673c0f73e29 100644
--- a/third_party/WebKit/Source/core/layout/ScrollAnchor.cpp
+++ b/third_party/WebKit/Source/core/layout/ScrollAnchor.cpp
@@ -76,18 +76,17 @@ static LayoutRect relativeBounds(const LayoutObject* layoutObject,
     localBounds = toLayoutBox(layoutObject)->borderBoxRect();
     if (!layoutObject->hasOverflowClip()) {
       // borderBoxRect doesn't include overflow content and floats.
-      LayoutUnit maxHeight =
-          std::max(localBounds.height(),
-                   toLayoutBox(layoutObject)->layoutOverflowRect().height());
+      LayoutUnit maxY =
+          std::max(localBounds.maxY(),
+                   toLayoutBox(layoutObject)->layoutOverflowRect().maxY());
       if (layoutObject->isLayoutBlockFlow() &&
           toLayoutBlockFlow(layoutObject)->containsFloats()) {
         // Note that lowestFloatLogicalBottom doesn't include floating
         // grandchildren.
-        maxHeight = std::max(
-            maxHeight,
-            toLayoutBlockFlow(layoutObject)->lowestFloatLogicalBottom());
+        maxY = std::max(
+            maxY, toLayoutBlockFlow(layoutObject)->lowestFloatLogicalBottom());
       }
-      localBounds.setHeight(maxHeight);
+      localBounds.shiftMaxYEdgeTo(maxY);
     }
   } else if (layoutObject->isText()) {
     // TODO(skobes): Use first and last InlineTextBox only?