Chrome Version: 55.0.2883.95
OS: macOS 10.12.2

What steps will reproduce the problem?
(1) Open http://w3c-test.org/html/semantics/forms/the-fieldset-element/disabled-001.html in Chrome
(2) Observe the test results

What is the expected result?
All the tests on the page should pass.

What happens instead?
One of the tests fails:
Fail    The <legend> element is not a child of the disabled fieldset: Its descendants should be disabled.
assert_false: the first legend is not a child of the disbled fieldset: input 'club3' is disabled expected false got true

Further details:
The HTML in question isn't conformant (<fieldset> is not allowed as a child of <legend>),
but the parser doesn't do any reparenting or similar,
so that doesn't matter for the purposes of this bug. (Yay tag soup.)

Anyway, per https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
> A form control is disabled if any of the following conditions are met:
> [...]
> 2. The element is a descendant of a <fieldset> element whose `disabled` attribute is specified
> and is not a descendant of that <fieldset> element's first <legend> element child, if any.

For the test in question, the relevant DOM subtree is:
┣ fieldset[disabled]#fs3
  ┗ fieldset
    ┗ legend
      ┗ input#club3

#fs3 is a disabled <fieldset>. #club3 is a descendant of #fs3.
#fs3 has no <legend> child. (The only <legend> is a child of the nameless enabled <fieldset>.)
Therefore, #club3 ought to be disabled. But Chrome enables it instead.