Pass correct *remaining* height to float manager, rather than the whole height of the content area. (Bug 563584, patch 22) r=roc

layout/generic/nsBlockReflowState.cpp

@@ -332,11 +332,12 @@ nsBlockReflowState::GetFloatAvailableSpaceWithState(
                "bad coord system");
 #endif
 
+  nscoord y = aY - BorderPadding().top;
+  nscoord height = (mContentArea.height == nscoord_MAX)
+                     ? nscoord_MAX : NS_MAX(mContentArea.height - y, 0);
   nsFlowAreaRect result =
-    mFloatManager->GetFlowArea(aY - BorderPadding().top, 
-                               nsFloatManager::BAND_FROM_POINT,
-                               mContentArea.height, mContentArea.width,
-                               aState);
+    mFloatManager->GetFlowArea(y, nsFloatManager::BAND_FROM_POINT,
+                               height, mContentArea.width, aState);
   // Keep the width >= 0 for compatibility with nsSpaceManager.
   if (result.mRect.width < 0)
     result.mRect.width = 0;