All ancestor multicols must have enough rows before laying out some inner multicol.

third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp

Index: third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp
diff --git a/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp b/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp
index 226b9d675a9d8f1ebe4c0b86819d0958bc92586c..a8fc25a54f1b6f7bf9d2c5031510a47b930f451e 100644
--- a/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp
@@ -384,7 +384,21 @@ void LayoutMultiColumnFlowThread::layoutColumns(SubtreeLayoutScope& layoutScope)
     // thread needs layout as well.
     layoutScope.setChildNeedsLayout(this);
 
-    m_blockOffsetInEnclosingFragmentationContext = enclosingFragmentationContext() ? multiColumnBlockFlow()->offsetFromLogicalTopOfFirstPage() : LayoutUnit();
+    if (FragmentationContext* enclosingFragmentationContext = this->enclosingFragmentationContext()) {
+        m_blockOffsetInEnclosingFragmentationContext = multiColumnBlockFlow()->offsetFromLogicalTopOfFirstPage();
+
+        if (LayoutMultiColumnFlowThread* enclosingFlowThread = enclosingFragmentationContext->associatedFlowThread()) {
+            if (LayoutMultiColumnSet* firstSet = firstMultiColumnSet()) {
+                // Before we can start to lay out the contents of this multicol container, we need
+                // to make sure that all ancestor multicol containers have established a row to hold
+                // the first column contents of this container (this multicol container may start at
+                // the beginning of a new outer row). Without sufficient rows in all ancestor
+                // multicol containers, we may use the wrong column height.
+                LayoutUnit offset = m_blockOffsetInEnclosingFragmentationContext + firstSet->logicalTopFromMulticolContentEdge();
+                enclosingFlowThread->appendNewFragmentainerGroupIfNeeded(offset, AssociateWithLatterPage);
+            }
+        }
+    }
 
     for (LayoutBox* columnBox = firstMultiColumnBox(); columnBox; columnBox = columnBox->nextSiblingMultiColumnBox()) {
         if (!columnBox->isLayoutMultiColumnSet()) {
@@ -455,7 +469,7 @@ FragmentationContext* LayoutMultiColumnFlowThread::enclosingFragmentationContext
     return view()->fragmentationContext();
 }
 
-void LayoutMultiColumnFlowThread::appendNewFragmentainerGroupIfNeeded(LayoutUnit bottomOffsetInFlowThread)
+void LayoutMultiColumnFlowThread::appendNewFragmentainerGroupIfNeeded(LayoutUnit offsetInFlowThread, PageBoundaryRule pageBoundaryRule)
 {
     if (!isPageLogicalHeightKnown()) {
         // If we have no clue about the height of the multicol container, bail. This situation
@@ -465,11 +479,12 @@ void LayoutMultiColumnFlowThread::appendNewFragmentainerGroupIfNeeded(LayoutUnit
         // Its height is indefinite for now.
         return;
     }
-    // TODO(mstensho): bottomOffsetInFlowThread is an endpoint-exclusive offset, i.e. the offset
-    // just after the bottom of some object. So, ideally, columnSetAtBlockOffset() should be
-    // informed about this (i.e. take a PageBoundaryRule argument). This is not the only place with
-    // this issue; see also pageRemainingLogicalHeightForOffset().
-    LayoutMultiColumnSet* columnSet = columnSetAtBlockOffset(bottomOffsetInFlowThread);
+    // TODO(mstensho): If pageBoundaryRule is AssociateWithFormerPage, offsetInFlowThread is an
+    // endpoint-exclusive offset, i.e. the offset just after the bottom of some object. So, ideally,
+    // columnSetAtBlockOffset() should be informed about this (i.e. take a PageBoundaryRule
+    // argument). This is not the only place with this issue; see also
+    // pageRemainingLogicalHeightForOffset().
+    LayoutMultiColumnSet* columnSet = columnSetAtBlockOffset(offsetInFlowThread);
     if (columnSet->isInitialHeightCalculated()) {
         // We only insert additional fragmentainer groups in the initial layout pass. We only want
         // to balance columns in the last fragmentainer group (if we need to balance at all), so we
@@ -477,7 +492,7 @@ void LayoutMultiColumnFlowThread::appendNewFragmentainerGroupIfNeeded(LayoutUnit
         return;
     }
 
-    if (!columnSet->hasFragmentainerGroupForColumnAt(bottomOffsetInFlowThread)) {
+    if (!columnSet->hasFragmentainerGroupForColumnAt(offsetInFlowThread, pageBoundaryRule)) {
         FragmentationContext* enclosingFragmentationContext = this->enclosingFragmentationContext();
         if (!enclosingFragmentationContext)
             return; // Not nested. We'll never need more rows than the one we already have then.
@@ -487,7 +502,7 @@ void LayoutMultiColumnFlowThread::appendNewFragmentainerGroupIfNeeded(LayoutUnit
         // multicol container. That in turn may mean that we've run out of columns there too.
         const MultiColumnFragmentainerGroup& newRow = columnSet->appendNewFragmentainerGroup();
         if (LayoutMultiColumnFlowThread* enclosingFlowThread = enclosingFragmentationContext->associatedFlowThread())
-            enclosingFlowThread->appendNewFragmentainerGroupIfNeeded(newRow.blockOffsetInEnclosingFragmentationContext() + newRow.logicalHeight());
+            enclosingFlowThread->appendNewFragmentainerGroupIfNeeded(newRow.blockOffsetInEnclosingFragmentationContext(), AssociateWithLatterPage);
     }
 }
 
@@ -956,7 +971,7 @@ void LayoutMultiColumnFlowThread::contentWasLaidOut(LayoutUnit logicalBottomInFl
     bool mayBeNested = multiColumnBlockFlow()->isInsideFlowThread() || view()->fragmentationContext();
     if (!mayBeNested)
         return;
-    appendNewFragmentainerGroupIfNeeded(logicalBottomInFlowThreadAfterPagination);
+    appendNewFragmentainerGroupIfNeeded(logicalBottomInFlowThreadAfterPagination, AssociateWithFormerPage);
 }
 
 bool LayoutMultiColumnFlowThread::canSkipLayout(const LayoutBox& root) const