This is actually a bug with the "unset" value exposed because this layout test actually sets tha "all" property! The test is: imported/blink/fast/block/float/overhanging-float-crashes-when-sibling-becomes-formatting-context.html
Created attachment 263317 [details] Patch
Comment on attachment 263317 [details] Patch rs=me
Fixed in r191201.
<rdar://problem/23771210>