When switching from the overflow lines to normal lines we must reset 'mInOverflowLines' or we'll compare 'mLine' to the wrong list on the next call. b=457375 r+sr=roc

layout/generic/nsBlockFrame.cpp

@@ -5188,6 +5188,7 @@ nsBlockInFlowLineIterator::Prev()
   PRBool currentlyInOverflowLines = mInOverflowLines != nsnull;
   while (PR_TRUE) {
     if (currentlyInOverflowLines) {
+      mInOverflowLines = nsnull;
       mLine = mFrame->end_lines();
       if (mLine != mFrame->begin_lines()) {
         --mLine;