1 files changed, 7 insertions, 5 deletions
diff --git a/chromium/third_party/blink/renderer/core/layout/ng/legacy_layout_tree_walking.h b/chromium/third_party/blink/renderer/core/layout/ng/legacy_layout_tree_walking.h
index e01bc5d90ec..afa57830aaf 100644
--- a/chromium/third_party/blink/renderer/core/layout/ng/legacy_layout_tree_walking.h
+++ b/chromium/third_party/blink/renderer/core/layout/ng/legacy_layout_tree_walking.h
@@ -24,11 +24,13 @@ inline LayoutObject* GetLayoutObjectForFirstChildNode(LayoutBlock* parent) {
   if (!child)
     return nullptr;
   if (UNLIKELY(child->IsLayoutFlowThread()))
-    return To<LayoutBlockFlow>(child)->FirstChild();
-  // The rendered legend is a child of the anonymous wrapper inside the fieldset
-  // container. If we find it, skip it. As far as NG is concerned, the rendered
-  // legend is a child of the fieldset container.
-  if (UNLIKELY(child->IsRenderedLegend()))
+    child = To<LayoutBlockFlow>(child)->FirstChild();
+  // The rendered legend is a child of the anonymous wrapper, inside the
+  // fieldset container. Or in the case of a multi-column, the rendered legend
+  // is a child of the multi-column flow thread, inside the anonymous wrapper
+  // and fieldset. If we find it, skip it. As far as NG is concerned, the
+  // rendered legend is a child of the fieldset container.
+  if (UNLIKELY(child && child->IsRenderedLegend()))
     return child->NextSibling();
   return child;
 }