In a constrained height situation, we need to reflow anything with floats. (Bug 563584, patch 25) Fixes assertion on layout/generic/crashtests/408883-1.html . r=roc

layout/generic/nsBlockFrame.cpp

@@ -1858,6 +1858,20 @@ nsBlockFrame::ReflowDirtyLines(nsBlockReflowState& aState)
       line->MarkDirty();
     }
 
+    // If we have a constrained height (i.e., breaking columns/pages),
+    // and the distance to the bottom might have changed, then we need
+    // to reflow any line that might have floats in it, both because the
+    // breakpoints within those floats may have changed and because we
+    // might have to push/pull the floats in their entirety.
+    // FIXME: What about a deltaY or height change that forces us to
+    // push lines?  Why does that work?
+    if (!line->IsDirty() &&
+        aState.mReflowState.availableHeight != NS_UNCONSTRAINEDSIZE &&
+        (deltaY != 0 || aState.mReflowState.mFlags.mVResize) &&
+        (line->IsBlock() || line->HasFloats() || line->HadFloatPushed())) {
+      line->MarkDirty();
+    }
+
     if (!line->IsDirty()) {
       // See if there's any reflow damage that requires that we mark the
       // line dirty.

layout/generic/nsBlockReflowState.cpp

@@ -436,7 +436,8 @@ nsBlockReflowState::SetupFloatContinuationList()
     // still be on our float continuations list.  However, that's
     // actually fine, since they'll all end up being stolen and
     // reordered into the correct order again.
-    // FIXME: Check this!
+    // (nsBlockFrame::ReflowDirtyLines ensures that any lines with
+    // pushed floats are reflowed.)
     mFloatContinuations = mBlock->EnsureFloatContinuations();
     SetFlag(BRS_PROPTABLE_FLOATCLIST, PR_TRUE);
   }

layout/generic/nsLineLayout.h

@@ -370,6 +370,9 @@ public:
   const nsLineList::iterator* GetLine() const {
     return GetFlag(LL_GOTLINEBOX) ? &mLineBox : nsnull;
   }
+  nsLineList::iterator* GetLine() {
+    return GetFlag(LL_GOTLINEBOX) ? &mLineBox : nsnull;
+  }
   
   /**
    * Returns the accumulated advance width of frames before the current frame