Try to avoid working on zero-height column sets, when possible.

third_party/WebKit/Source/core/layout/LayoutMultiColumnFlowThread.cpp

 /*
  * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 445 matching lines @@
       LayoutMultiColumnSet* previousSet =
           columnSet->previousSiblingMultiColumnSet();
       if (!previousSet)
         break;
       columnSet = previousSet;
     }
   } else {
     DCHECK(!m_columnSetsInvalidated);
     if (m_multiColumnSetList.isEmpty())
       return nullptr;
-    if (offset < LayoutUnit())
-      return m_multiColumnSetList.first();
+    if (offset < LayoutUnit()) {
+      columnSet = m_multiColumnSetList.first();
+    } else {
+      MultiColumnSetSearchAdapter adapter(offset);
+      m_multiColumnSetIntervalTree
+          .allOverlapsWithAdapter<MultiColumnSetSearchAdapter>(adapter);
 
-    MultiColumnSetSearchAdapter adapter(offset);
-    m_multiColumnSetIntervalTree
-        .allOverlapsWithAdapter<MultiColumnSetSearchAdapter>(adapter);
-
-    // If no set was found, the offset is in the flow thread overflow.
-    if (!adapter.result() && !m_multiColumnSetList.isEmpty())
-      return m_multiColumnSetList.last();
-    columnSet = adapter.result();
+      // If no set was found, the offset is in the flow thread overflow.
+      if (!adapter.result() && !m_multiColumnSetList.isEmpty())
+        columnSet = m_multiColumnSetList.last();
+      else
+        columnSet = adapter.result();
+    }
   }
   if (pageBoundaryRule == AssociateWithFormerPage && columnSet &&
       offset == columnSet->logicalTopInFlowThread()) {
     // The column set that we found starts at the exact same flow thread offset
     // as we specified. Since we are to associate offsets at boundaries with the
     // former fragmentainer, the fragmentainer we're looking for is in the
     // previous column set.
     if (LayoutMultiColumnSet* previousSet =
             columnSet->previousSiblingMultiColumnSet())
-      return previousSet;
+      columnSet = previousSet;
+  }
+  // Avoid returning zero-height column sets, if possible. We found a column set
+  // based on a flow thread coordinate. If multiple column sets share that
+  // coordinate (because we have zero-height column sets between column
+  // spanners, for instance), look for one that has a height.
+  for (LayoutMultiColumnSet* walker = columnSet; walker;
+       walker = walker->nextSiblingMultiColumnSet()) {
+    if (!walker->isPageLogicalHeightKnown())
+      continue;
+    if (walker->logicalTopInFlowThread() == offset)
+      return walker;
+    break;
   }
   return columnSet;
 }
 
 void LayoutMultiColumnFlowThread::layoutColumns(
     SubtreeLayoutScope& layoutScope) {
   // Since we ended up here, it means that the multicol container (our parent)
   // needed layout. Since contents of the multicol container are diverted to the
   // flow thread, the flow thread needs layout as well.
   layoutScope.setChildNeedsLayout(this);
@@ skipping 858 matching lines @@
     const {
   return MultiColumnLayoutState(m_lastSetWorkedOn);
 }
 
 void LayoutMultiColumnFlowThread::restoreMultiColumnLayoutState(
     const MultiColumnLayoutState& state) {
   m_lastSetWorkedOn = state.columnSet();
 }
 
 }  // namespace blink