From 946ae9ce3a299bd3aae95c1f0b743d13d95d6cf3 Mon Sep 17 00:00:00 2001
From: Scott Johnson <sjohnson@mozilla.com>
Date: Mon, 4 Mar 2013 14:15:18 -0600
Subject: [PATCH] Bug 810726: Simplify logic for handling too many columns to
 prevent crash. [r=roc]

---
 layout/generic/crashtests/810726-2.html   | 57 +++++++++++++++++++++++
 layout/generic/crashtests/810726.html     |  8 ++++
 layout/generic/crashtests/crashtests.list |  1 +
 layout/generic/nsColumnSetFrame.cpp       | 33 ++++++-------
 4 files changed, 79 insertions(+), 20 deletions(-)
 create mode 100644 layout/generic/crashtests/810726-2.html
 create mode 100644 layout/generic/crashtests/810726.html
diff --git a/layout/generic/crashtests/810726-2.html b/layout/generic/crashtests/810726-2.html
new file mode 100644
index 000000000000..cff07dc171a4
--- /dev/null
+++ b/layout/generic/crashtests/810726-2.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <style type="text/css">
+      body {
+        font-size: 0.875em;
+        line-height: 1.30em;
+        font-family: Arial;
+      }
+
+      p, ul, li {
+        margin: 0;
+        padding: 0;
+        background-color: rgb(235, 235, 235);
+      }
+
+      ul { -moz-column-count: 2;
+           background-color: rgb(255, 200, 200);
+         }
+
+      li { margin-left: 17px }
+      .wrapper {
+                background-color: rgb(255, 0, 155); max-width: 910px;
+                border: 1px solid green;
+               }
+
+      .column {
+        width: 73%;
+        padding: 20px 60px 20px 40px;
+        -moz-box-sizing: border-box;
+        background-color: rgb(0, 95, 255);
+      }
+
+      .img {
+        float: left;
+        width: 261px;
+        height: 150px;
+        background-color: rgb(88, 20, 100);
+      }
+    </style>
+  </head>
+  <body>
+    <div class="wrapper">
+      <div id="colEle" class="column">
+        <ul>
+          <li>
+            <p>123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123</p>
+          </li>
+          <li>
+            <p>123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123</p>
+            <div class="img"></div>
+          </li>
+        </ul>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/810726.html b/layout/generic/crashtests/810726.html
new file mode 100644
index 000000000000..04bd439a4a67
--- /dev/null
+++ b/layout/generic/crashtests/810726.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+  <head>
+  </head>
+  <body>
+    <iframe width="1200" height="1024" src="810726-2.html">
+  </body>
+</html>
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index a9051731be6e..da3d4a3cdba7 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -439,6 +439,7 @@ test-pref(layout.css.flexbox.enabled,true) load 798235-1.html
 test-pref(layout.css.flexbox.enabled,true) load 799207-1.html
 asserts(12) test-pref(layout.css.flexbox.enabled,true) load 799207-2.html
 test-pref(layout.css.flexbox.enabled,true) load 804089-1.xhtml
+load 810726.html
 load 840818.html
 test-pref(layout.css.flexbox.enabled,true) load 812822-1.html
 asserts(1) test-pref(layout.css.flexbox.enabled,true) load 824297-1.html # bug 399262
diff --git a/layout/generic/nsColumnSetFrame.cpp b/layout/generic/nsColumnSetFrame.cpp
index f4c4c09a4704..193de92752dd 100644
--- a/layout/generic/nsColumnSetFrame.cpp
+++ b/layout/generic/nsColumnSetFrame.cpp
@@ -749,34 +749,27 @@ nsColumnSetFrame::ReflowChildren(nsHTMLReflowMetrics&     aDesiredSize,
 
 
       if ((contentBottom > aReflowState.mComputedMaxHeight ||
-          contentBottom > aReflowState.ComputedHeight()) &&
-          aConfig.mBalanceColCount < INT32_MAX) {
+           contentBottom > aReflowState.ComputedHeight()) &&
+           aConfig.mBalanceColCount < INT32_MAX) {
         // We overflowed vertically, but have not exceeded the number
         // of columns. If we're balancing, then we should try reverting
         // to auto instead.
         aColData.mShouldRevertToAuto = true;
+        break;
       }
 
       if (columnCount >= aConfig.mBalanceColCount) {
-        if (contentBottom >= aReflowState.availableHeight) {
-          // No more columns allowed here. Stop.
-          aStatus |= NS_FRAME_REFLOW_NEXTINFLOW;
-          kidNextInFlow->AddStateBits(NS_FRAME_IS_DIRTY);
-          // Move any of our leftover columns to our overflow list. Our
-          // next-in-flow will eventually pick them up.
-          const nsFrameList& continuationColumns = mFrames.RemoveFramesAfter(child);
-          if (continuationColumns.NotEmpty()) {
-            SetOverflowFrames(PresContext(), continuationColumns);
-          }
-          child = nullptr;
-          break;
-        } else if (contentBottom > aReflowState.mComputedMaxHeight ||
-                   contentBottom > aReflowState.ComputedHeight()) {
-          aColData.mShouldRevertToAuto = true;
-        } else {
-          // The number of columns required is too high.
-          allFit = false;
+        // No more columns allowed here. Stop.
+        aStatus |= NS_FRAME_REFLOW_NEXTINFLOW;
+        kidNextInFlow->AddStateBits(NS_FRAME_IS_DIRTY);
+        // Move any of our leftover columns to our overflow list. Our
+        // next-in-flow will eventually pick them up.
+        const nsFrameList& continuationColumns = mFrames.RemoveFramesAfter(child);
+        if (continuationColumns.NotEmpty()) {
+          SetOverflowFrames(PresContext(), continuationColumns);
         }
+        child = nullptr;
+        break;
       }
     }
 
