Save float's next sibling since reflowing it could change the next sibling. (Bug 563584, patch 16) r=roc

layout/generic/nsBlockFrame.cpp

@@ -5740,9 +5740,13 @@ nsBlockFrame::ReflowFloatContinuations(nsBlockReflowState& aState,
                                        nsReflowStatus&     aStatus)
 {
   nsresult rv = NS_OK;
-  for (nsIFrame* f = mFloats.FirstChild();
+  for (nsIFrame* f = mFloats.FirstChild(), *next;
        f && (f->GetStateBits() & NS_FRAME_IS_FLOAT_CONTINUATION);
-       f = f->GetNextSibling()) {
+       f = next) {
+    // save next sibling now, since reflowing could push the entire
+    // float, changing its siblings
+    next = f->GetNextSibling();
+
     if (NS_SUBTREE_DIRTY(f) || aState.mReflowState.ShouldReflowAllKids()) {
       // Cache old bounds
       nsRect oldRect = f->GetRect();