Make sure that no column rows get negative flow thread portion heights.

Source/core/layout/LayoutMultiColumnFlowThread.cpp

 /*
  * Copyright (C) 2012 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 575 matching lines @@
         columnSet->detachFromFlowThread();
     multiColumnBlockFlow()->resetMultiColumnFlowThread();
     LayoutFlowThread::willBeRemovedFromTree();
 }
 
 void LayoutMultiColumnFlowThread::skipColumnSpanner(LayoutBox* layoutObject, LayoutUnit logicalTopInFlowThread)
 {
     ASSERT(layoutObject->isColumnSpanAll());
     LayoutMultiColumnSpannerPlaceholder* placeholder = layoutObject->spannerPlaceholder();
     LayoutBox* previousColumnBox = placeholder->previousSiblingMultiColumnBox();
-    if (previousColumnBox && previousColumnBox->isLayoutMultiColumnSet())
-        toLayoutMultiColumnSet(previousColumnBox)->endFlow(logicalTopInFlowThread);
+    if (previousColumnBox && previousColumnBox->isLayoutMultiColumnSet()) {
+        LayoutMultiColumnSet* columnSet = toLayoutMultiColumnSet(previousColumnBox);
+        if (logicalTopInFlowThread < columnSet->logicalTopInFlowThread())
+            logicalTopInFlowThread = columnSet->logicalTopInFlowThread(); // Negative margins may cause this.
+        columnSet->endFlow(logicalTopInFlowThread);
+    }
     LayoutBox* nextColumnBox = placeholder->nextSiblingMultiColumnBox();
     if (nextColumnBox && nextColumnBox->isLayoutMultiColumnSet()) {
         LayoutMultiColumnSet* nextSet = toLayoutMultiColumnSet(nextColumnBox);
         m_lastSetWorkedOn = nextSet;
         nextSet->beginFlow(logicalTopInFlowThread);
     }
 
     // We'll lay out of spanners after flow thread layout has finished (during layout of the spanner
     // placeholders). There may be containing blocks for out-of-flow positioned descendants of the
     // spanner in the flow thread, so that out-of-flow objects inside the spanner will be laid out
@@ skipping 297 matching lines @@
 }
 
 bool LayoutMultiColumnFlowThread::isPageLogicalHeightKnown() const
 {
     if (LayoutMultiColumnSet* columnSet = lastMultiColumnSet())
         return columnSet->pageLogicalHeight();
     return false;
 }
 
 }