See the URL field with Google Chrome. The baseline of "MMMyyy" looks wrong only with type=search x-webkit-speech.
I'm not sure why this happens only with type=search yet. Anyway, the speech button should be ignored for baseline calculation. In RenderBlock::lastLineBoxBaseline(), boxes with isFloatingOrPositioned() are ignored for baseline calculation. the speech button also should be ignored in lastLineBoxBaseline().
I seems WebKit doesn't have this problem any more. Probably r87067 fixed it?