InitialColumnHeightFinder needs to take all expected rows into account.

third_party/WebKit/Source/core/layout/ColumnBalancer.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/layout/LayoutMultiColumnSet.h"
 
 namespace blink {
 
 // A column balancer traverses a portion of the subtree of a flow thread that
 // belongs to one or more fragmentainer groups within one column set, in order
@@ skipping 132 matching lines @@
   // Return the accumulated space used by struts at all column boundaries
   // preceding the specified flowthread offset.
   LayoutUnit spaceUsedByStrutsAt(LayoutUnit offsetInFlowThread) const;
 
   // Add a content run, specified by its end position. A content run is appended
   // at every forced/explicit break and at the end of the column set. The
   // content runs are used to determine where implicit/soft breaks will occur,
   // in order to calculate an initial column height.
   void addContentRun(LayoutUnit endOffsetInFlowThread);
 
+  // Normally we'll just return 0 here, because in most cases we won't add more
+  // content runs than used column-count. However, if we're at the initial
+  // balancing pass for a multicol that lives inside another to-be-balanced
+  // outer multicol container, and there is a sufficient number of forced column
+  // breaks, we may exceed used column-count. In such cases, we're going to
+  // assume a minimal number of fragmentainer groups (rows) that will eventually
+  // be created, and when distributing implicit column breaks to calculate an
+  // initial balanced height, we'll only focus on content that has any chance at
+  // all to end up in the last row.
+  unsigned firstContentRunIndexInLastRow() const {
+    unsigned columnCount = columnSet().usedColumnCount();
+    if (m_contentRuns.size() <= columnCount)
+      return 0;
+    unsigned lastRunIndex = m_contentRuns.size() - 1;

[eae, 2016/11/10 23:37:12]

Is columnCount  guaranteed to be at least one? If not please add a check/DCHECK.

[mstensho (USE GERRIT), 2016/11/11 08:47:46]

There should be no way for it to be 0, or we'd be in trouble all over the place.
Still, we actually had an assertion for this in
InitialColumnHeightFinder::recordStrutBeforeOffset(). I'll move it to
ColumnBalancer() instead, so that we always check it.

Done.

+    return lastRunIndex / columnCount * columnCount;
+  }
+
   // Return the index of the content run with the currently tallest columns,
   // taking all implicit breaks assumed so far into account.
   unsigned contentRunIndexWithTallestColumns() const;
 
   // Given the current list of content runs, make assumptions about where we
   // need to insert implicit breaks (if there's room for any at all; depending
   // on the number of explicit breaks), and store the results. This is needed in
   // order to balance the columns.
   void distributeImplicitBreaks();
 
@@ skipping 81 matching lines @@
 
   // Set when breaking before a block, and we're looking for the first
   // unbreakable descendant, in order to report correct space shortage for that
   // one.
   LayoutUnit m_pendingStrut;
 
   unsigned m_forcedBreaksCount;
 };
 
 }  // namespace blink