Remove the VerticalScroll() before layout, nsListBoxBodyFrame does that in its post reflow callback. b=547338 r=roc

layout/generic/crashtests/crashtests.list

@@ -296,4 +296,5 @@ load 541277-1.html
 load 541277-2.html
 load 541714-1.html
 load 541714-2.html
+load 547338.xul
 load 551635-1.html

layout/generic/nsGfxScrollFrame.cpp

@@ -21,7 +21,7 @@
  *
  * Contributor(s):
  *   Pierre Phaneuf <pp@ludusdesign.com>
- *   Mats Palmgren <mats.palmgren@bredband.net>
+ *   Mats Palmgren <matspal@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),

layout/generic/nsIFrame.h

@@ -2507,6 +2507,7 @@ protected:
 
 private:
   nsRect* GetOverflowAreaProperty(PRBool aCreateIfNecessary = PR_FALSE);
+  friend class nsListBoxLayout;  // needs SetOverflowRect
   void SetOverflowRect(const nsRect& aRect);
 
 #ifdef NS_DEBUG

layout/xul/base/src/nsListBoxLayout.cpp

@@ -141,6 +141,14 @@ nsListBoxLayout::Layout(nsIBox* aBox, nsBoxLayoutState& aState)
     nscoord pos = frame->GetYPosition();
     PRInt32 rowHeight = frame->GetRowHeightAppUnits();
     if (pos != (rowHeight*index)) {
+      // At this point the overflow rect has not yet been updated to account
+      // for a frame size change.  VerticalScroll() leads to GetScrolledRect()
+      // which uses the overflow rect so we need to update it now (bug 547338).
+      if (frame->HasOverflowRect()) {
+        nsRect overflowRect = nsRect(nsPoint(0, 0), frame->GetSize());
+        overflowRect.UnionRect(overflowRect, frame->GetOverflowRect());
+        frame->SetOverflowRect(overflowRect);
+      }
       frame->VerticalScroll(rowHeight*index);
       frame->Redraw(aState, nsnull, PR_FALSE);
     }