--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -1549,22 +1549,24 @@ CanScrollWithBlitting(nsIFrame* aFrame, 
 static void
 InvalidateFixedBackgroundFramesFromList(nsDisplayListBuilder* aBuilder,
                                         const nsDisplayList& aList)
 {
   for (nsDisplayItem* item = aList.GetBottom(); item; item = item->GetAbove()) {
     nsDisplayList* sublist = item->GetList();
     if (sublist) {
       InvalidateFixedBackgroundFramesFromList(aBuilder, *sublist);
-    } else if (item->IsVaryingRelativeToMovingFrame(aBuilder)) {
+      continue;
+    }
+    nsIFrame* f = item->GetUnderlyingFrame();
+    if (f && aBuilder->IsMovingFrame(f) &&
+        item->IsVaryingRelativeToMovingFrame(aBuilder)) {
       if (item->IsFixedAndCoveringViewport(aBuilder)) {
         // FrameLayerBuilder takes care of scrolling these
       } else {
-        nsIFrame* f = item->GetUnderlyingFrame();
-        NS_ASSERTION(f, "No underlying frame for varying item?");
         f->Invalidate(item->GetVisibleRect() - aBuilder->ToReferenceFrame(f));
       }
     }
   }
 }
 
 static void
 InvalidateFixedBackgroundFrames(nsIFrame* aRootFrame,
@@ -1587,16 +1589,17 @@ InvalidateFixedBackgroundFrames(nsIFrame
   builder.LeavePresShell(aRootFrame, aUpdateRect);
   if (NS_FAILED(rv))
     return;
 
   nsRegion visibleRegion(aUpdateRect);
   list.ComputeVisibility(&builder, &visibleRegion, nsnull);
 
   InvalidateFixedBackgroundFramesFromList(&builder, list);
+  list.DeleteAll();
 }
 
 PRBool nsGfxScrollFrameInner::IsAlwaysActive() const
 {
   // The root scrollframe for a non-chrome document which is the direct
   // child of a chrome document is always treated as "active".
   // XXX maybe we should extend this so that IFRAMEs which are fill the
   // entire viewport (like GMail!) are always active
@@ -1643,17 +1646,17 @@ void nsGfxScrollFrameInner::ScrollVisual
     flags |= nsIFrame::INVALIDATE_NO_THEBES_LAYERS;
   }
   MarkActive();
   mOuter->InvalidateWithFlags(mScrollPort, flags);
 
   if (flags & nsIFrame::INVALIDATE_NO_THEBES_LAYERS) {
     // XXX fix this to transform rectangle properly
     InvalidateFixedBackgroundFrames(displayRoot, mScrolledFrame,
-                                    mScrolledFrame->GetRect() + mOuter->GetOffsetTo(displayRoot));
+      GetScrollPortRect() + mOuter->GetOffsetTo(displayRoot));
   }
 }
 
 static PRInt32
 ClampInt(nscoord aLower, nscoord aVal, nscoord aUpper, nscoord aAppUnitsPerPixel)
 {
   PRInt32 low = NSToIntCeil(float(aLower)/aAppUnitsPerPixel);
   PRInt32 high = NSToIntFloor(float(aUpper)/aAppUnitsPerPixel);