4 files changed, 11 insertions, 3 deletions
diff --git a/layout/generic/ReflowInput.cpp b/layout/generic/ReflowInput.cpp
index 2f91f5f65c..c8b01fff19 100644
--- a/layout/generic/ReflowInput.cpp
+++ b/layout/generic/ReflowInput.cpp
@@ -304,7 +304,8 @@ bool ReflowInput::ShouldReflowAllKids() const {
   // frames NS_FRAME_CONTAINS_RELATIVE_BSIZE is marked on.
   return mFrame->HasAnyStateBits(NS_FRAME_IS_DIRTY) || IsIResize() ||
          (IsBResize() &&
-          mFrame->HasAnyStateBits(NS_FRAME_CONTAINS_RELATIVE_BSIZE));
+          mFrame->HasAnyStateBits(NS_FRAME_CONTAINS_RELATIVE_BSIZE)) ||
+         mFlags.mIsInLastColumnBalancingReflow;
 }
 
 void ReflowInput::SetComputedISize(nscoord aComputedISize,
diff --git a/layout/generic/ReflowInput.h b/layout/generic/ReflowInput.h
index 0b7f64b543..370ccc1af2 100644
--- a/layout/generic/ReflowInput.h
+++ b/layout/generic/ReflowInput.h
@@ -503,6 +503,11 @@ struct ReflowInput : public SizeComputationInput {
     // nsColumnSetFrame is balancing columns
     bool mIsColumnBalancing : 1;
 
+    // We have an ancestor nsColumnSetFrame performing the last column balancing
+    // reflow. The available block-size of the last column might become
+    // unconstrained.
+    bool mIsInLastColumnBalancingReflow : 1;
+
     // True if ColumnSetWrapperFrame has a constrained block-size, and is going
     // to consume all of its block-size in this fragment. This bit is passed to
     // nsColumnSetFrame to determine whether to give up balancing and create
diff --git a/layout/generic/nsColumnSetFrame.cpp b/layout/generic/nsColumnSetFrame.cpp
index 699afaece7..ec349e9ab4 100644
--- a/layout/generic/nsColumnSetFrame.cpp
+++ b/layout/generic/nsColumnSetFrame.cpp
@@ -662,6 +662,8 @@ nsColumnSetFrame::ColumnBalanceData nsColumnSetFrame::ReflowColumns(
       }();
       kidReflowInput.mFlags.mTableIsSplittable = false;
       kidReflowInput.mFlags.mIsColumnBalancing = aConfig.mIsBalancing;
+      kidReflowInput.mFlags.mIsInLastColumnBalancingReflow =
+          aConfig.mIsLastBalancingReflow;
       kidReflowInput.mBreakType = ReflowInput::BreakType::Column;
 
       // We need to reflow any float placeholders, even if our column block-size
diff --git a/layout/generic/nsImageMap.cpp b/layout/generic/nsImageMap.cpp
index 8ddd9338f2..ce621fb6be 100644
--- a/layout/generic/nsImageMap.cpp
+++ b/layout/generic/nsImageMap.cpp
@@ -467,7 +467,7 @@ void PolyArea::Draw(nsIFrame* aFrame, DrawTarget& aDrawTarget,
       Point p1(pc->CSSPixelsToDevPixels(mCoords[0]),
                pc->CSSPixelsToDevPixels(mCoords[1]));
       Point p2, p1snapped, p2snapped;
-      for (int32_t i = 2; i < mNumCoords; i += 2) {
+      for (int32_t i = 2; i < mNumCoords - 1; i += 2) {
         p2.x = pc->CSSPixelsToDevPixels(mCoords[i]);
         p2.y = pc->CSSPixelsToDevPixels(mCoords[i + 1]);
         p1snapped = p1;
@@ -493,7 +493,7 @@ void PolyArea::GetRect(nsIFrame* aFrame, nsRect& aRect) {
     nscoord x1, x2, y1, y2, xtmp, ytmp;
     x1 = x2 = nsPresContext::CSSPixelsToAppUnits(mCoords[0]);
     y1 = y2 = nsPresContext::CSSPixelsToAppUnits(mCoords[1]);
-    for (int32_t i = 2; i < mNumCoords; i += 2) {
+    for (int32_t i = 2; i < mNumCoords - 1; i += 2) {
       xtmp = nsPresContext::CSSPixelsToAppUnits(mCoords[i]);
       ytmp = nsPresContext::CSSPixelsToAppUnits(mCoords[i + 1]);
       x1 = x1 < xtmp ? x1 : xtmp;