The attached test case has nested columns, where both outer and inner columns have only 1 column, and their content has larger block-size than its container.

Loading the test case can create zero column-boxes indefinitely. It happens after bug 1569701, but I think this is an existing bug in nsColumnSet's reflow because we don't handle overflow contents properly in nested columns after enabling column-span. If we are lucky, this may also fix some of the fuzzing-column-span bugs.

This is the test case mentioned in comment 0.

That is when ColumnSet gives its last ::moz-column-content unbounded
available block-size in the very first balancing iteration.

Note that the last column's available block-size isn't
really unbounded yet, but we'll make it happen in the next part.

Every time I read the code, the name blockReflowInput makes me think
the variable is an instance of BlockReflowInput, but it is not.

Depends on D43126

This patch affects only if column-span is enabled. It fixed a lot of
fuzzing test cases which will be added in next part.

It changes the column balancing behavior in the following ways.

1. By using unconstrained block-size to measure the last column in first
   balancing iteration, we can guarantee that the mKnownInfeasibleBSize is the
   correct feasible block-size.

2. Always reflow one more time if the content cannot fit the available
   content block-size. Due to 1), the content (last column) always return
   fully complete in the first balancing iteration even if it's in an inner
   column with a constrained available block-size. We need to reflow
   again to get the correct incomplete reflow status so that the outer
   column can create next-in-flows for the inner column.

3. ColumnSet gives up balancing only when ColumnSetWrapper is running
   out of its block-size. When columns in nested, we prioritize fragmenting
   the inner column container over creating overflow columns within the
   inner column container.

Depends on D43127

1346454-1.html and 1346454-2.html are moved to keep the list sorted.

Depends on D43128

A try run for patches from comment 2 to comment 5.

https://hg.mozilla.org/mozilla-central/rev/95b4fc380349
https://hg.mozilla.org/mozilla-central/rev/d72dc8614374
https://hg.mozilla.org/mozilla-central/rev/66042c8f7236
https://hg.mozilla.org/mozilla-central/rev/400cbd234621