Adding some test code for a single tinderbox run so I can see what's going onwith Tp2 and such. Will back out after one cycle.

layout/base/nsPresShell.cpp

@@ -4681,6 +4681,11 @@ PresShell::StyleSheetAdded(nsIDocument *aDocument,
   aStyleSheet->GetApplicable(applicable);
 
   if (applicable && aStyleSheet->HasRules()) {
+    if (mDidInitialReflow) {
+      nsCAutoString uri;
+      mDocument->GetDocumentURI()->GetSpec(uri);
+      printf("Sheet added after StartLayout on %s\n", uri.get());
+    }
     mStylesHaveChanged = PR_TRUE;
   }
 }
@@ -4695,6 +4700,11 @@ PresShell::StyleSheetRemoved(nsIDocument *aDocument,
   PRBool applicable;
   aStyleSheet->GetApplicable(applicable);
   if (applicable && aStyleSheet->HasRules()) {
+    if (mDidInitialReflow) {
+      nsCAutoString uri;
+      mDocument->GetDocumentURI()->GetSpec(uri);
+      printf("Sheet removed after StartLayout on %s\n", uri.get());
+    }
     mStylesHaveChanged = PR_TRUE;
   }
 }
@@ -4705,6 +4715,11 @@ PresShell::StyleSheetApplicableStateChanged(nsIDocument *aDocument,
                                             PRBool aApplicable)
 {
   if (aStyleSheet->HasRules()) {
+    if (mDidInitialReflow) {
+      nsCAutoString uri;
+      mDocument->GetDocumentURI()->GetSpec(uri);
+      printf("Sheet state toggled after StartLayout on %s\n", uri.get());
+    }
     mStylesHaveChanged = PR_TRUE;
   }
 }

layout/generic/nsHTMLFrame.cpp

@@ -612,6 +612,12 @@ CanvasFrame::Reflow(nsPresContext*          aPresContext,
     FinishAndStoreOverflow(&aDesiredSize);
   }
 
+  nsCAutoString uri;
+  mContent->GetDocument()->GetDocumentURI()->GetSpec(uri);
+  printf("Finished canvas reflow for %s:\n"
+         "Height: %d, overflow height: %d\n",
+         uri.get(), aDesiredSize.height, aDesiredSize.mOverflowArea.height);
+
   NS_FRAME_TRACE_REFLOW_OUT("CanvasFrame::Reflow", aStatus);
   NS_FRAME_SET_TRUNCATION(aStatus, aReflowState, aDesiredSize);
   return NS_OK;