Stay within the containing block when looking for a line to dirty.

third_party/WebKit/Source/core/layout/line/LineBoxList.cpp

Index: third_party/WebKit/Source/core/layout/line/LineBoxList.cpp
diff --git a/third_party/WebKit/Source/core/layout/line/LineBoxList.cpp b/third_party/WebKit/Source/core/layout/line/LineBoxList.cpp
index 77b3069d5110660677a1922f67850af17ce08149..29888e5529daebad3b6c03170f6ae4e62360f505 100644
--- a/third_party/WebKit/Source/core/layout/line/LineBoxList.cpp
+++ b/third_party/WebKit/Source/core/layout/line/LineBoxList.cpp
@@ -293,11 +293,13 @@ void LineBoxList::dirtyLinesFromChangedChild(LineLayoutItem container,
   RootInlineBox* box = nullptr;
   LineLayoutItem curr = child.previousSibling();
   if (child.isFloating() && !curr) {
-    LineLayoutItem parent = child.parent();
-    while (parent && parent.isLayoutInline() && !parent.previousSibling())
-      parent = parent.parent();
-    if (parent)
-      curr = parent.previousSibling();
+    LineLayoutInline outerInline;
+    for (LineLayoutItem parent = child.parent();
+         parent && parent.isLayoutInline() && !parent.previousSibling();
+         parent = parent.parent())
+      outerInline = LineLayoutInline(parent);
+    if (outerInline)
+      curr = outerInline.previousSibling();
   }
 
   for (; curr; curr = curr.previousSibling()) {