Bug 1405813 - Move prev-in-flow's EOC list to this container frame's OC list in NormalizeChildLists(). r=dholbert

Differential Revision: https://phabricator.services.mozilla.com/D78848

layout/generic/crashtests/1405813.html

@@ -0,0 +1,10 @@
+<style>
+* { height: 0vmin; padding-bottom: 1vmax; display: grid; columns: 0px }
+</style>
+<details>
+<summary>
+V
+<link>
+<content>
+>
+<video>

layout/generic/crashtests/crashtests.list

@@ -683,6 +683,7 @@ load 1401709.html
 load 1401807.html
 load 1404222-empty-shape.html
 load 1405443.html
+load 1405813.html
 load 1405896.html
 load 1406252-1.html
 load 1415185.html

layout/generic/nsContainerFrame.cpp

@@ -1798,10 +1798,16 @@ void nsContainerFrame::NormalizeChildLists() {
       }
       MergeSortedOverflow(continuations);
 
-      // Move trailing OC next-in-flows into our excess overflow containers
+      // Move prev-in-flow's excess overflow containers list into our own
+      // overflow containers list. If we already have an excess overflow
+      // containers list, any child in that list which doesn't have a
+      // prev-in-flow in this frame is also merged into our overflow container
       // list.
       nsFrameList* overflowContainers =
-          GetPropTableFrames(OverflowContainersProperty());
+          DrainExcessOverflowContainersList(MergeSortedFrameListsFor);
+
+      // Move trailing OC next-in-flows into our excess overflow containers
+      // list.
       if (overflowContainers) {
         nsFrameList moveToEOC;
         for (nsIFrame* f = overflowContainers->FirstChild(); f;) {

layout/generic/nsContainerFrame.h

@@ -613,7 +613,7 @@ class nsContainerFrame : public nsSplittableFrame {
 
   /**
    * This is intended to be used as a ChildFrameMerger argument for
-   * ReflowOverflowContainerChildren().
+   * ReflowOverflowContainerChildren() and DrainExcessOverflowContainersList().
    */
   static inline void MergeSortedFrameListsFor(nsFrameList& aDest,
                                               nsFrameList& aSrc,