The analysis is similar to bug 1586470 comment 3. Fixing bug 1168921 is not enough. [BlockReflowInput::ComputeBlockAvailSpace](https://searchfox.org/mozilla-central/rev/97976753a21c1731e18177de9e5ce78ea3b3da2d/layout/generic/nsBlockFrame.cpp#3494-3495) can still return `aResult` with a negative `BSize()`.
Bug 1588954 Comment 1 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
The analysis is similar to bug 1586470 comment 3. Fixing bug 1168921 is not enough. [BlockReflowInput::ComputeBlockAvailSpace](https://searchfox.org/mozilla-central/rev/97976753a21c1731e18177de9e5ce78ea3b3da2d/layout/generic/nsBlockFrame.cpp#3494-3495) can still return `availSpace` with a negative `BSize()`.