--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -291,9 +291,10 @@ load 517968.html
 load 520340.html
 load 533379-1.html
 load 533379-2.html
 load 534082-1.html
 load 541277-1.html
 load 541277-2.html
 load 541714-1.html
 load 541714-2.html
+load 547338.xul
 load 551635-1.html

--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -16,17 +16,17 @@
  *
  * The Initial Developer of the Original Code is
  * Netscape Communications Corporation.
  * Portions created by the Initial Developer are Copyright (C) 1998
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
  *   Pierre Phaneuf <pp@ludusdesign.com>
- *   Mats Palmgren <mats.palmgren@bredband.net>
+ *   Mats Palmgren <matspal@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
  * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your

--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -2502,16 +2502,17 @@ protected:
    *              used by this method: 
    *              Input: mDirection
    *              Output: mResultContent, mContentOffset
    */
    nsresult PeekOffsetParagraph(nsPeekOffsetStruct *aPos);
 
 private:
   nsRect* GetOverflowAreaProperty(PRBool aCreateIfNecessary = PR_FALSE);
+  friend class nsListBoxLayout;  // needs SetOverflowRect
   void SetOverflowRect(const nsRect& aRect);
 
 #ifdef NS_DEBUG
 public:
   // Formerly nsIFrameDebug
   NS_IMETHOD  List(FILE* out, PRInt32 aIndent) const = 0;
   NS_IMETHOD  GetFrameName(nsAString& aResult) const = 0;
   NS_IMETHOD_(nsFrameState)  GetDebugStateBits() const = 0;

--- a/layout/xul/base/src/nsListBoxLayout.cpp
+++ b/layout/xul/base/src/nsListBoxLayout.cpp
@@ -136,16 +136,24 @@ nsListBoxLayout::Layout(nsIBox* aBox, ns
   // This is an edge case that was caused by the row height
   // changing after a scroll had occurred.  (Bug #51084)
   PRInt32 index;
   frame->GetIndexOfFirstVisibleRow(&index);
   if (index > 0) {
     nscoord pos = frame->GetYPosition();
     PRInt32 rowHeight = frame->GetRowHeightAppUnits();
     if (pos != (rowHeight*index)) {
+      // At this point the overflow rect has not yet been updated to account
+      // for a frame size change.  VerticalScroll() leads to GetScrolledRect()
+      // which uses the overflow rect so we need to update it now (bug 547338).
+      if (frame->HasOverflowRect()) {
+        nsRect overflowRect = nsRect(nsPoint(0, 0), frame->GetSize());
+        overflowRect.UnionRect(overflowRect, frame->GetOverflowRect());
+        frame->SetOverflowRect(overflowRect);
+      }
       frame->VerticalScroll(rowHeight*index);
       frame->Redraw(aState, nsnull, PR_FALSE);
     }
   }
 
   nsresult rv = LayoutInternal(aBox, aState);
   if (NS_FAILED(rv)) return rv;