Testcase coming up; the issue is caused by the presshell being retrieved before the layout is flushed. (Bug discovered through code inspection; I haven't seen anyone try this.)
Created attachment 265501 [details] [diff] [review] Patch Fix + some cleanup. (I'm changing the behavior of the HTML calculation slightly, but I doubt anyone cares what the results are with overflow set on both the root element and the body.)
Comment on attachment 265501 [details] [diff] [review] Patch Not sure if you're the right person to ask for review, but you r+ed the last patch to this code.
Comment on attachment 265501 [details] [diff] [review] Patch This has too much layout specific stuff for me. Please ask one of the layout guys instead. I can sr though unless the reviewer r/sr it.
+ nsresult rv = GetViewportSize(&width, &height); + *aHeight = height; Why can't you just do "return GetViewportSize(&width, aHeight);" like you did in the other part of the patch?
Created attachment 265753 [details] [diff] [review] Patch v2 With more consistent style.
It looks like this may have caused Bug 381746
(This was checked in at 2007-05-22 20:52.) Should this be marked fixed?
Oh yeah, forgot to mark it.