found this with Valgrind... http://lxr.mozilla.org/mozilla/source/layout/html/base/src/nsGfxScrollFrame.cpp#1024 1024 PRBool hasHorizontalScrollbar; 1025 PRBool fit = AddRemoveScrollbar(hasHorizontalScrollbar, aScrollAreaSize.y, aScrollAreaSize.height, hSize.height, aOnTop, aAdd); 1026 mHasHorizontalScrollbar = hasHorizontalScrollbar; |hasHorizontalScrollbar| is not initialized 1072 // not enough room? Yes? Return true. 1073 if (size >= aSbSize) { 1074 aHasScrollbar = aAdd; 1075 aSize = size; 1076 return PR_TRUE; 1077 } 1078 1079 return PR_FALSE; If (size < aSbSize), |aHasScrollbar| is returned with whatever value it had when AddRemoveScrollbar was called (uninitialized). The caller goes on to use the value of |hasHorizontalScrollbar| at line 1026. The same thing happens with |hasVerticalScrollbar|.

Andrew Schultz, I have added a patch of attachment 95959 [details] [diff] [review] in bug 156982. Please take a look to see whether it can fix this one. Thanks!

fixed by bug 163800 thanks Pete!