Calling container() on floats should only skip LayoutInline ancestors.

third_party/WebKit/Source/core/layout/LayoutObject.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2011 Apple Inc.
  *               All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved.
  *               (http://www.torchmobile.com/)
@@ skipping 2486 matching lines @@
     if (skipInfo) {
       // We jumped directly from the spanner to the multicol container. Need to
       // check if we skipped |ancestor| or filter/reflection on the way.
       for (LayoutObject* walker = parent();
            walker && walker != multicolContainer; walker = walker->parent())
         skipInfo->update(*walker);
     }
     return multicolContainer;
   }
 
-  if (isFloating())
-    return containingBlock(skipInfo);
+  if (isFloating()) {
+    // Skip non-atomic inline ancestors, but nothing else. We want to stop at
+    // e.g. LayoutMedia objects, since they act as containing blocks but do not
+    // inherit from LayoutBlock (so we cannot just use containingBlock() here).
+    for (LayoutObject* walker = parent(); walker; walker = walker->parent()) {
+      if (!walker->isLayoutInline())
+        return walker;
+      if (skipInfo)
+        skipInfo->update(*walker);
+    }
+  }
 
   return parent();
 }
 
 inline LayoutObject* LayoutObject::paintInvalidationParent() const {
   if (isLayoutView())
     return LayoutAPIShim::layoutObjectFrom(frame()->ownerLayoutItem());
   return parent();
 }
 
@@ skipping 978 matching lines @@
     const blink::LayoutObject* root = object1;
     while (root->parent())
       root = root->parent();
     root->showLayoutTreeAndMark(object1, "*", object2, "-", 0);
   } else {
     WTFLogAlways("%s", "Cannot showLayoutTree. Root is (nil)");
   }
 }
 
 #endif