contentEditable sets -webkit-line-break:after-white-space, but it can also be enabled manually, like in the attached test.

This declaration triggers a special code path in line layout, which involves BreakingContext::skipTrailingWhitespace(). Here we search for floats at the end of the line and insert them.

Later on, when we get to BreakingContext::handleFloat() (which is also run when -webkit-line-break has its initial value), we also insert each float (but the insertion code detects that they have already been inserted, so that part is fine). If the first float fits on the line, we go ahead and place *all* floats that have been inserted (not just the one we're handling), before we have checked each float individually if it fits on the line or not.

Floats that don't fit on the line shouldn't be placed until we're done laying out the line, because it's only then that we know the height of the line that those floats should be pushed below.

This is an old bug - maybe as old as the BreakingContext::skipTrailingWhitespace() thing, but I haven't checked.
 

Deleted: tc.html 368 bytes

tc.html 368 bytes View Download