Comment 19 for bug 327863

Making some more progress debugging here: as far as I can tell, nsGfxScrollFrameInner is fine. It's correctly determining that the box does not need scroll bars, and correctly setting the height of the horizontal scroll bar to zero. But in between when it does that and when we actually draw anything, the pres shell finds the horizontal scrollbar frame on its mDirtyRoots list and calls its Reflow method, which begins by delegating to nsBoxFrame::Reflow, which resets the height of the scroll bar to its intrinsic height. That's not fatal by itself; nsScrollBarFrame::Reflow is aware that nsGfxScrollFrame may have set its width or height to zero to hide it, so it checks whether the availableWidth/availableHeight in its aReflowState argument are zero, and if so, overrides the corresponding 'desired size' values back to zero, which in turn causes nsPresShell to zap the scrollbar height back to zero.

Now here's the kicker: somewhere in between the call to SetBounds(state, r) on line 754 of nsBoxFrame.cpp (this is nsBoxFrame::Reflow), and the special check in nsScrollBarFrame::Reflow, *something* is stomping on aReflowState.availableHeight: it was 0 and it becomes 0x40000000 (NS_INTRINSICSIZE/NS_UNCONSTRAINEDSIZE). However, infuriatingly, no GDB watchpoint fires when this happens, so I am failing to find the event.