Stop appending fragmentainer groups when flow thread offset approaches infinity.

third_party/WebKit/Source/core/layout/LayoutMultiColumnSet.cpp

 /*
  * Copyright (C) 2012 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 240 matching lines @@
     return false;
   }
 
   // So, there's not enough room in the last fragmentainer group. However,
   // there can only ever be one fragmentainer group per column set if we're not
   // nested inside another fragmentation context. We'll just create overflowing
   // columns if the fragmentainer group cannot hold all the content.
   if (!multiColumnFlowThread()->enclosingFragmentationContext())
     return false;
 
+  // If we have reached the limits of what a LayoutUnit can hold, we better
+  // stop, or we'd end up with zero-height columns.
+  if (offsetInFlowThread.mightBeSaturated())
+    return false;
+
   // We're in a nested fragmentation context, and the last fragmentainer group
   // cannot hold content at the specified offset without overflowing. This
   // usually warrants a new fragmentainer group; however, this will not be the
   // case if we have already allocated all available block space in this
   // multicol container. When setting up a new fragmentainer group, we always
   // constrain against the remaining portion of any specified
   // height/max-height. This means that we shouldn't allow creation of
   // fragmentainer groups below the bottom of the multicol container, or we'd
   // end up with zero-height fragmentainer groups (or actually 1px; see
   // heightAdjustedForRowOffset() in MultiColumnFragmentainerGroup, which
@@ skipping 339 matching lines @@
   // Now add in column rule bounds, if present.
   Vector<LayoutRect> columnRuleBounds;
   if (computeColumnRuleBounds(LayoutPoint(), columnRuleBounds)) {
     for (auto& bound : columnRuleBounds)
       blockFlowBounds.unite(bound);
   }
   return blockFlowBounds;
 }
 
 }  // namespace blink