The column balancer should ignore things outside the bounds of the row.

third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp

Index: third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
diff --git a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
index d99d6b844b3a0db0db718ceda3a7a2a242c584ed..a3c5f574b68ce5697e704040fe343c6f03d897ba 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
@@ -1694,8 +1694,8 @@ Element* AXLayoutObject::anchorElement() const
 
     // Search up the layout tree for a LayoutObject with a DOM node. Defer to an earlier continuation, though.
     for (currLayoutObject = m_layoutObject; currLayoutObject && !currLayoutObject->node(); currLayoutObject = currLayoutObject->parent()) {
-        if (currLayoutObject->isAnonymousBlock()) {
-            LayoutObject* continuation = toLayoutBlock(currLayoutObject)->continuation();
+        if (currLayoutObject->isAnonymousBlock() && currLayoutObject->isLayoutBlockFlow()) {
+            LayoutObject* continuation = toLayoutBlockFlow(currLayoutObject)->continuation();
             if (continuation)
                 return cache.getOrCreate(continuation)->anchorElement();
         }