Stay within the containing block when looking for a line to dirty.

third_party/WebKit/Source/core/layout/line/LineBoxList.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 275 matching lines @@
     return;
   }
 
   // Try to figure out which line box we belong in. First try to find a previous
   // line box by examining our siblings. If we are a float inside an inline then
   // check the siblings of our inline parent. If we didn't find a line box, then
   // use our parent's first line box.
   RootInlineBox* box = nullptr;
   LineLayoutItem curr = child.previousSibling();
   if (child.isFloating() && !curr) {
-    LineLayoutItem parent = child.parent();
-    while (parent && parent.isLayoutInline() && !parent.previousSibling())
-      parent = parent.parent();
-    if (parent)
-      curr = parent.previousSibling();
+    LineLayoutInline outerInline;
+    for (LineLayoutItem parent = child.parent();
+         parent && parent.isLayoutInline() && !parent.previousSibling();
+         parent = parent.parent())
+      outerInline = LineLayoutInline(parent);
+    if (outerInline)
+      curr = outerInline.previousSibling();
   }
 
   for (; curr; curr = curr.previousSibling()) {
     if (curr.isFloatingOrOutOfFlowPositioned())
       continue;
 
     if (curr.isAtomicInlineLevel()) {
       InlineBox* wrapper = LineLayoutBox(curr).inlineBoxWrapper();
       if (wrapper)
         box = &wrapper->root();
@@ skipping 62 matching lines @@
     ASSERT(child->prevLineBox() == prev);
     prev = child;
   }
   ASSERT(prev == m_lastLineBox);
 #endif
 }
 
 #endif
 
 }  // namespace blink