Bug 724978: Make nsColumnSetFrame handle absolutely positioned children without crashing. [p=ehsan, r=fantasai]