diff --git a/mozilla/layout/generic/nsBlockBandData.cpp b/mozilla/layout/generic/nsBlockBandData.cpp
index 7f2c6ecb966..39f2f87b35b 100644
--- a/mozilla/layout/generic/nsBlockBandData.cpp
+++ b/mozilla/layout/generic/nsBlockBandData.cpp
@@ -167,6 +167,7 @@ nsBlockBandData::ComputeAvailSpaceRect()
   }
 
   nsBandTrapezoid* trapezoid = mTrapezoids;
+  // The trapezoid to the left of the first right-floated trapezoid.
   nsBandTrapezoid* rightTrapezoid = nsnull;
 
   PRInt32 leftFloats = 0;
@@ -226,6 +227,9 @@ nsBlockBandData::ComputeAvailSpaceRect()
   mLeftFloats = leftFloats;
   mRightFloats = rightFloats;
 
+  // We look for available space in the last trapezoid before the
+  // first right float, or in the last trapezoid if there is no right
+  // float or no trapezoid before the first right float.
   if (nsnull != rightTrapezoid) {
     trapezoid = rightTrapezoid;
   }
diff --git a/mozilla/layout/generic/nsBlockReflowState.cpp b/mozilla/layout/generic/nsBlockReflowState.cpp
index 684394258c9..7537122b67e 100644
--- a/mozilla/layout/generic/nsBlockReflowState.cpp
+++ b/mozilla/layout/generic/nsBlockReflowState.cpp
@@ -983,6 +983,20 @@ nsBlockReflowState::FlowAndPlaceFloat(nsFloatCache*   aFloatCache,
   }
 
   nsRect region(floatX, floatY, floatSize.width, floatSize.height);
+  
+  // Don't send rectangles with negative margin-box width or height to
+  // the space manager; it can't deal with them.
+  if (region.width < 0) {
+    // Preserve the right margin-edge for left floats and the left
+    // margin-edge for right floats
+    if (isLeftFloat) {
+      region.x = region.XMost();
+    }
+    region.width = 0;
+  }
+  if (region.height < 0) {
+    region.height = 0;
+  }
 #ifdef DEBUG
   nsresult rv =
 #endif
@@ -1022,8 +1036,8 @@ nsBlockReflowState::FlowAndPlaceFloat(nsFloatCache*   aFloatCache,
   // Set the origin of the float frame, in frame coordinates. These
   // coordinates are <b>not</b> relative to the spacemanager
   // translation, therefore we have to factor in our border/padding.
-  nscoord x = borderPadding.left + aFloatCache->mMargins.left + region.x;
-  nscoord y = borderPadding.top + aFloatCache->mMargins.top + region.y;
+  nscoord x = borderPadding.left + aFloatCache->mMargins.left + floatX;
+  nscoord y = borderPadding.top + aFloatCache->mMargins.top + floatY;
 
   // If float is relatively positioned, factor that in as well
   // XXXldb Should this be done after handling the combined area
diff --git a/mozilla/layout/generic/nsSpaceManager.cpp b/mozilla/layout/generic/nsSpaceManager.cpp
index 7a349c85c5d..89fb6e81f25 100644
--- a/mozilla/layout/generic/nsSpaceManager.cpp
+++ b/mozilla/layout/generic/nsSpaceManager.cpp
@@ -806,6 +806,9 @@ nsresult
 nsSpaceManager::AddRectRegion(nsIFrame* aFrame, const nsRect& aUnavailableSpace)
 {
   NS_PRECONDITION(nsnull != aFrame, "null frame");
+  NS_PRECONDITION(aUnavailableSpace.width >= 0 &&
+                  aUnavailableSpace.height >= 0,
+                  "Negative dimensions not allowed");
 
   // See if there is already a region associated with aFrame
   FrameInfo*  frameInfo = GetFrameInfoFor(aFrame);
@@ -1328,7 +1331,8 @@ nsSpaceManager::BandRect::~BandRect()
 nsSpaceManager::BandRect*
 nsSpaceManager::BandRect::SplitVertically(nscoord aBottom)
 {
-  NS_PRECONDITION((aBottom > mTop) && (aBottom < mBottom), "bad argument");
+  // Allow aBottom == mTop, so we can split off an empty rectangle
+  NS_PRECONDITION((aBottom >= mTop) && (aBottom < mBottom), "bad argument");
 
   // Create a new band rect for the bottom part
   BandRect* bottomBandRect;
@@ -1347,7 +1351,8 @@ nsSpaceManager::BandRect::SplitVertically(nscoord aBottom)
 nsSpaceManager::BandRect*
 nsSpaceManager::BandRect::SplitHorizontally(nscoord aRight)
 {
-  NS_PRECONDITION((aRight > mLeft) && (aRight < mRight), "bad argument");
+  // Allow aRight == mLeft, so we can split off an empty rectangle
+  NS_PRECONDITION((aRight >= mLeft) && (aRight < mRight), "bad argument");
   
   // Create a new band rect for the right part
   BandRect* rightBandRect;