Remaining page height should never be 0 when told to AssociateWithLatterPage.

third_party/WebKit/Source/core/layout/LayoutMultiColumnSet.cpp

 /*
  * Copyright (C) 2012 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 70 matching lines @@
     LayoutUnit pageLogicalHeight = row.logicalHeight();
     ASSERT(pageLogicalHeight); // It's not allowed to call this method if the height is unknown.
     LayoutUnit pageLogicalBottom = row.columnLogicalTopForOffset(offsetInFlowThread) + pageLogicalHeight;
     LayoutUnit remainingLogicalHeight = pageLogicalBottom - offsetInFlowThread;
 
     if (pageBoundaryRule == AssociateWithFormerPage) {
         // An offset exactly at a column boundary will act as being part of the former column in
         // question (i.e. no remaining space), rather than being part of the latter (i.e. one whole
         // column length of remaining space).
         remainingLogicalHeight = intMod(remainingLogicalHeight, pageLogicalHeight);
+    } else if (!remainingLogicalHeight) {
+        // When pageBoundaryRule is AssociateWithLatterPage, we should never return 0, because if
+        // there's no space left, it means that we should be at a column boundary, in which case we
+        // should return the amount of space remaining in the *next* column. But this is not true if
+        // the offset is "infinite" (saturated), so allow this to happen in that case.
+        ASSERT(offsetInFlowThread.mightBeSaturated());
+        remainingLogicalHeight = pageLogicalHeight;
     }
     return remainingLogicalHeight;
 }
 
 bool LayoutMultiColumnSet::isPageLogicalHeightKnown() const
 {
     return firstFragmentainerGroup().logicalHeight();
 }
 
 LayoutUnit LayoutMultiColumnSet::nextLogicalTopForUnbreakableContent(LayoutUnit flowThreadOffset, LayoutUnit contentLogicalHeight) const
@@ skipping 318 matching lines @@
 
 LayoutRect LayoutMultiColumnSet::flowThreadPortionRect() const
 {
     LayoutRect portionRect(LayoutUnit(), logicalTopInFlowThread(), pageLogicalWidth(), logicalHeightInFlowThread());
     if (!isHorizontalWritingMode())
         return portionRect.transposedRect();
     return portionRect;
 }
 
 } // namespace blink