Bug 1178250 - Don't call ConsiderChildOverflow until the child has been placed in the right location when reflowing a vertical-rl table. r=dholbert

layout/tables/nsTableFrame.cpp

@@ -1916,12 +1916,6 @@ nsTableFrame::Reflow(nsPresContext*           aPresContext,
       mutable_rs.mFlags.mSpecialBSizeReflow = false;
     }
   }
-  else {
-    // Calculate the overflow area contribution from our children.
-    for (nsIFrame* kid : mFrames) {
-      ConsiderChildOverflow(aDesiredSize.mOverflowAreas, kid);
-    }
-  }
 
   aDesiredSize.ISize(wm) = aReflowState.ComputedISize() +
     aReflowState.ComputedLogicalBorderPadding().IStartEnd(wm);
@@ -1941,6 +1935,14 @@ nsTableFrame::Reflow(nsPresContext*           aPresContext,
     }
   }
 
+  // Calculate the overflow area contribution from our children. We couldn't
+  // do this on the fly during ReflowChildren(), because in vertical-rl mode
+  // with unconstrained width, we weren't placing them in their final positions
+  // until the fixupKidPositions loop just above.
+  for (nsIFrame* kid : mFrames) {
+    ConsiderChildOverflow(aDesiredSize.mOverflowAreas, kid);
+  }
+
   LogicalMargin borderPadding = GetChildAreaOffset(wm, &aReflowState);
   SetColumnDimensions(aDesiredSize.BSize(wm), wm, borderPadding,
                       aDesiredSize.Width());
@@ -3259,7 +3261,6 @@ nsTableFrame::ReflowChildren(nsTableReflowState& aReflowState,
         aReflowState.availSize.BSize(wm) -= cellSpacingB + kidRect.BSize(wm);
       }
     }
-    ConsiderChildOverflow(aOverflowAreas, kidFrame);
   }
 
   // We've now propagated the column resizes and geometry changes to all