Merge 85971 - https://bugs.webkit.org/show_bug.cgi?id=60398 (<rdar://problem/9307696>)

Source/WebCore/rendering/InlineFlowBox.cpp

 /*
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 521 matching lines @@
         // and the root box's baseline.  The value is negative if the child box's baseline is above the
         // root box's baseline, and it is positive if the child box's baseline is below the root box's baseline.
         curr->setLogicalTop(rootBox->verticalPositionForBox(curr, verticalPositionCache));
         
         int ascent = 0;
         int descent = 0;
         rootBox->ascentAndDescentForBox(curr, textBoxDataMap, ascent, descent, affectsAscent, affectsDescent);
 
         int boxHeight = ascent + descent;
         if (curr->verticalAlign() == TOP) {
-            if (maxPositionTop < ascent)
+            if (maxPositionTop < boxHeight)
                 maxPositionTop = boxHeight;
         } else if (curr->verticalAlign() == BOTTOM) {
             if (maxPositionBottom < boxHeight)
                 maxPositionBottom = boxHeight;
         } else if (!inlineFlowBox || strictMode || inlineFlowBox->hasTextChildren() || (inlineFlowBox->descendantsHaveSameLineHeightAndBaseline() && inlineFlowBox->hasTextDescendants())
                    || inlineFlowBox->boxModelObject()->hasInlineDirectionBordersOrPadding()) {
             // Note that these values can be negative.  Even though we only affect the maxAscent and maxDescent values
             // if our box (excluding line-height) was above (for ascent) or below (for descent) the root baseline, once you factor in line-height
             // the final box can end up being fully above or fully below the root box's baseline!  This is ok, but what it
             // means is that ascent and descent (including leading), can end up being negative.  The setMaxAscent and
@@ skipping 889 matching lines @@
         ASSERT(child->prevOnLine() == prev);
         prev = child;
     }
     ASSERT(prev == m_lastChild);
 #endif
 }
 
 #endif
 
 } // namespace WebCore