Adding tall content may require insertion of more than one additional column row.

third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp

 /*
  * Copyright (C) 2012 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 479 matching lines @@
         // to balance columns in the last fragmentainer group (if we need to balance at all), so we
         // want that last fragmentainer group to be the same one in all layout passes that follow.
         return;
     }
 
     if (!columnSet->hasFragmentainerGroupForColumnAt(offsetInFlowThread, pageBoundaryRule)) {
         FragmentationContext* enclosingFragmentationContext = this->enclosingFragmentationContext();
         if (!enclosingFragmentationContext)
             return; // Not nested. We'll never need more rows than the one we already have then.
         ASSERT(!isLayoutPagedFlowThread());
-        // We have run out of columns here, so we add another row to hold more columns. When we add
-        // a new row, it implicitly means that we're inserting another column in our enclosing
-        // multicol container. That in turn may mean that we've run out of columns there too.
-        const MultiColumnFragmentainerGroup& newRow = columnSet->appendNewFragmentainerGroup();
-        if (LayoutMultiColumnFlowThread* enclosingFlowThread = enclosingFragmentationContext->associatedFlowThread())
-            enclosingFlowThread->appendNewFragmentainerGroupIfNeeded(newRow.blockOffsetInEnclosingFragmentationContext(), AssociateWithLatterPage);
+
+        // We have run out of columns here, so we need to add at least one more row to hold more
+        // columns.
+        do {
+            const MultiColumnFragmentainerGroup& newRow = columnSet->appendNewFragmentainerGroup();
+            // Zero-height rows should really not occur here, but if it does anyway, break, so that
+            // we don't get stuck in an infinite loop.
+            ASSERT(newRow.logicalHeight() > 0);
+            if (newRow.logicalHeight() <= 0)
+                break;
+        } while (!columnSet->hasFragmentainerGroupForColumnAt(offsetInFlowThread, pageBoundaryRule));
+
+        if (LayoutMultiColumnFlowThread* enclosingFlowThread = enclosingFragmentationContext->associatedFlowThread()) {
+            // When we add a new row here, it implicitly means that we're inserting another column
+            // in our enclosing multicol container. That in turn may mean that we've run out of
+            // columns there too.
+            const MultiColumnFragmentainerGroup& lastRow = columnSet->lastFragmentainerGroup();
+            enclosingFlowThread->appendNewFragmentainerGroupIfNeeded(lastRow.blockOffsetInEnclosingFragmentationContext(), AssociateWithLatterPage);
+        }
     }
 }
 
 bool LayoutMultiColumnFlowThread::isFragmentainerLogicalHeightKnown()
 {
     return isPageLogicalHeightKnown();
 }
 
 LayoutUnit LayoutMultiColumnFlowThread::fragmentainerLogicalHeightAt(LayoutUnit blockOffset)
 {
@@ skipping 475 matching lines @@
         }
         if (canContainSpannerInParentFragmentationContext(*object))
             next = object->nextInPreOrder(&root);
         else
             next = object->nextInPreOrderAfterChildren(&root);
     }
     return true;
 }
 
 } // namespace blink