The column balancer needs to look inside inlines.

third_party/WebKit/Source/core/layout/ColumnBalancer.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/ColumnBalancer.h"
 
 #include "core/layout/LayoutMultiColumnFlowThread.h"
 #include "core/layout/LayoutMultiColumnSet.h"
 #include "core/layout/api/LineLayoutBlockFlow.h"
 
 namespace blink {
 
 ColumnBalancer::ColumnBalancer(const LayoutMultiColumnSet& columnSet,
                                LayoutUnit logicalTopInFlowThread,
                                LayoutUnit logicalBottomInFlowThread)
     : m_columnSet(columnSet),
       m_logicalTopInFlowThread(logicalTopInFlowThread),
       m_logicalBottomInFlowThread(logicalBottomInFlowThread) {}
 
 void ColumnBalancer::traverse() {
   traverseSubtree(*columnSet().flowThread());
   ASSERT(!flowThreadOffset());
 }
 
 void ColumnBalancer::traverseSubtree(const LayoutBox& box) {
   if (box.childrenInline() && box.isLayoutBlockFlow()) {
     // Look for breaks between lines.
-    for (const RootInlineBox* line = toLayoutBlockFlow(box).firstRootBox();
-         line; line = line->nextRootBox()) {
-      LayoutUnit lineTopInFlowThread =
-          m_flowThreadOffset + line->lineTopWithLeading();
-      if (lineTopInFlowThread < logicalTopInFlowThread())
-        continue;
-      if (lineTopInFlowThread >= logicalBottomInFlowThread())
-        break;
-      examineLine(*line);
-    }
+    traverseLines(toLayoutBlockFlow(box));
   }
 
+  // Look for breaks between and inside block-level children. Even if this is a
+  // block flow with inline children, there may be interesting floats to examine
+  // here.
+  traverseChildren(box);
+}
+
+void ColumnBalancer::traverseLines(const LayoutBlockFlow& blockFlow) {
+  for (const RootInlineBox* line = blockFlow.firstRootBox(); line;
+       line = line->nextRootBox()) {
+    LayoutUnit lineTopInFlowThread =
+        m_flowThreadOffset + line->lineTopWithLeading();
+    if (lineTopInFlowThread < logicalTopInFlowThread())
+      continue;
+    if (lineTopInFlowThread >= logicalBottomInFlowThread())
+      break;
+    examineLine(*line);
+  }
+}
+
+void ColumnBalancer::traverseChildren(const LayoutObject& object) {
+  // The break-after value from the previous in-flow block-level object to be
+  // joined with the break-before value of the next in-flow block-level sibling.
+  EBreak previousBreakAfterValue = BreakAuto;
+
   const LayoutFlowThread* flowThread = columnSet().flowThread();
   bool isHorizontalWritingMode = flowThread->isHorizontalWritingMode();
 
-  // The break-after value from the previous in-flow block-level object to be
-  // joined with the break-before value of the next in-flow block-level sibling.
-  EBreak previousBreakAfterValue = BreakAuto;
+  for (const LayoutObject* child = object.slowFirstChild(); child;
+       child = child->nextSibling()) {
+    if (!child->isBox()) {
+      // Keep traversing inside inlines. There may be floats there.
+      if (child->isLayoutInline())
+        traverseChildren(*child);
+      continue;
+    }
 
-  // Look for breaks between and inside block-level children. Even if this is a
-  // block flow with inline children, there may be interesting floats to examine
-  // here.
-  for (const LayoutObject* child = box.slowFirstChild(); child;
-       child = child->nextSibling()) {
-    if (!child->isBox() || child->isInline())
-      continue;
     const LayoutBox& childBox = toLayoutBox(*child);
     LayoutRect overflowRect = childBox.layoutOverflowRect();
     LayoutUnit childLogicalBottomWithOverflow =
         childBox.logicalTop() +
         (isHorizontalWritingMode ? overflowRect.maxY() : overflowRect.maxX());
     if (m_flowThreadOffset + childLogicalBottomWithOverflow <=
         logicalTopInFlowThread()) {
       // This child is fully above the flow thread portion we're examining.
       continue;
     }
@@ skipping 340 matching lines @@
   if (group.columnLogicalTopForOffset(lineTopInFlowThread) !=
       group.columnLogicalTopForOffset(lineBottomWithOverflow)) {
     LayoutUnit shortage =
         lineBottomWithOverflow -
         group.columnLogicalTopForOffset(lineBottomWithOverflow);
     recordSpaceShortage(shortage);
   }
 }
 
 }  // namespace blink