Fix incorrectly painted right floats in LayoutNG

third_party/WebKit/Source/core/layout/ng/ng_block_node.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/ng/ng_block_node.h"
 
 #include "core/layout/LayoutBlockFlow.h"
 #include "core/layout/api/LineLayoutAPIShim.h"
 #include "core/layout/line/InlineIterator.h"
 #include "core/layout/ng/layout_ng_block_flow.h"
@@ skipping 252 matching lines @@
     }
 
     // Ensure the position of the children are copied across to the
     // LayoutObject tree.
   } else {
     for (const auto& child_fragment : fragment_->Children()) {
       if (child_fragment->IsPlaced())
         FragmentPositionUpdated(toNGPhysicalBoxFragment(*child_fragment));
 
       for (const auto& floating_object : child_fragment->PositionedFloats()) {
-        FloatingObjectPositionedUpdated(floating_object, layout_box_);
+        FloatingObjectPositionedUpdated(
+            floating_object, toLayoutBox(child_fragment->GetLayoutObject()));
       }
     }
   }
 
   if (layout_box_->isLayoutBlock())
     toLayoutBlock(layout_box_)->layoutPositionedObjects(true);
   layout_box_->clearNeedsLayout();
   if (layout_box_->isLayoutBlockFlow()) {
     toLayoutBlockFlow(layout_box_)->updateIsSelfCollapsing();
   }
@@ skipping 63 matching lines @@
 // Save static position for legacy AbsPos layout.
 void NGBlockNode::SaveStaticOffsetForLegacy(const NGLogicalOffset& offset) {
   DCHECK(layout_box_);
   DCHECK(layout_box_->isOutOfFlowPositioned());
   DCHECK(layout_box_->layer());
   layout_box_->layer()->setStaticBlockPosition(offset.block_offset);
   layout_box_->layer()->setStaticInlinePosition(offset.inline_offset);
 }
 
 }  // namespace blink