Bug 1666592 - Check overflow list's emptiness as soon as we finish using it. r=dholbert

Differential Revision: https://phabricator.services.mozilla.com/D91991

layout/generic/crashtests/1666592.html

@@ -0,0 +1,2 @@
+<style>#a{display:flex;flex-flow:column-reverse}:not(w){column-width:1px</style><l id="a"><<label id="a">x<l>x</label>a i
+

layout/generic/crashtests/crashtests.list

@@ -783,3 +783,4 @@ load 1648577.html
 load 1652618.html
 load 1652897.html
 asserts(0-7) load 1654925.html
+load 1666592.html

layout/generic/nsContainerFrame.cpp

@@ -1877,13 +1877,14 @@ void nsContainerFrame::NormalizeChildLists() {
         f = next;
       }
 
+      if (ourOverflow->IsEmpty()) {
+        DestroyOverflowList();
+        ourOverflow = nullptr;
+      }
       if (items.NotEmpty()) {
         PullItemsNextInFlow(items);
       }
       MergeSortedFrameLists(mFrames, items, GetContent());
-      if (ourOverflow->IsEmpty()) {
-        DestroyOverflowList();
-      }
     }
   }