Bug 370439 (sort of). GetAbsPosClipRect needs to take the new frame size as a parameter, because the current frame size may be invalid when we are called by FinishAndStoreOverflow. r+sr=dbaron

layout/generic/nsBlockFrame.cpp

@@ -500,7 +500,7 @@ nsBlockFrame::InvalidateInternal(const nsRect& aDamageRect,
   // with CSS 'clip'.
   const nsStyleDisplay* disp = GetStyleDisplay();
   nsRect absPosClipRect;
-  if (GetAbsPosClipRect(disp, &absPosClipRect)) {
+  if (GetAbsPosClipRect(disp, &absPosClipRect, GetSize())) {
     // Restrict the invalidated area to abs-pos clip rect
     // abs-pos clipping clips everything in the frame
     nsRect r;

layout/generic/nsFrame.cpp

@@ -1102,7 +1102,8 @@ nsFrame::DisplayBorderBackgroundOutline(nsDisplayListBuilder*   aBuilder,
 }
 
 PRBool
-nsIFrame::GetAbsPosClipRect(const nsStyleDisplay* aDisp, nsRect* aRect)
+nsIFrame::GetAbsPosClipRect(const nsStyleDisplay* aDisp, nsRect* aRect,
+                            const nsSize& aSize)
 {
   NS_PRECONDITION(aRect, "Must have aRect out parameter");
 
@@ -1112,10 +1113,10 @@ nsIFrame::GetAbsPosClipRect(const nsStyleDisplay* aDisp, nsRect* aRect)
 
   *aRect = aDisp->mClip;
   if (NS_STYLE_CLIP_RIGHT_AUTO & aDisp->mClipFlags) {
-    aRect->width = GetSize().width - aRect->x;
+    aRect->width = aSize.width - aRect->x;
   }
   if (NS_STYLE_CLIP_BOTTOM_AUTO & aDisp->mClipFlags) {
-    aRect->height = GetSize().height - aRect->y;
+    aRect->height = aSize.height - aRect->y;
   }
   return PR_TRUE;
 }
@@ -1123,9 +1124,9 @@ nsIFrame::GetAbsPosClipRect(const nsStyleDisplay* aDisp, nsRect* aRect)
 static PRBool ApplyAbsPosClipping(nsDisplayListBuilder* aBuilder,
                                   const nsStyleDisplay* aDisp, nsIFrame* aFrame,
                                   nsRect* aRect) {
-  if (!aFrame->GetAbsPosClipRect(aDisp, aRect))
+  if (!aFrame->GetAbsPosClipRect(aDisp, aRect, aFrame->GetSize()))
     return PR_FALSE;
-  
+
   // A moving frame should not be allowed to clip a non-moving frame.
   // Abs-pos clipping always clips frames below it in the frame tree, except
   // for when an abs-pos frame clips a fixed-pos frame. So when fixed-pos
@@ -5348,7 +5349,7 @@ nsIFrame::FinishAndStoreOverflow(nsRect* aOverflowArea, nsSize aNewSize)
 
   PRBool hasAbsPosClip;
   nsRect absPosClipRect;
-  hasAbsPosClip = GetAbsPosClipRect(disp, &absPosClipRect);
+  hasAbsPosClip = GetAbsPosClipRect(disp, &absPosClipRect, aNewSize);
   if (hasAbsPosClip) {
     outlineRect.IntersectRect(outlineRect, absPosClipRect);
   }

layout/generic/nsIFrame.h

@@ -1789,7 +1789,8 @@ NS_PTR_TO_INT32(frame->GetProperty(nsGkAtoms::embeddingLevel))
    * to the computed clip rect coordinates relative to this frame's origin.
    * aRect must not be null!
    */
-  PRBool GetAbsPosClipRect(const nsStyleDisplay* aDisp, nsRect* aRect);
+  PRBool GetAbsPosClipRect(const nsStyleDisplay* aDisp, nsRect* aRect,
+                           const nsSize& aSize);
 
   /**
    * Check if this frame is focusable and in the current tab order.