When trying to select text that's a direct descendant of a block with overflow:auto or scroll, scrolling is ignored, so you end up selecting text above or to the left of where you're pointing or dragging. To reproduce, open the testcase, scroll each overflow down or to the right, and the drag across the text to make a selection. Note that this happens only with text that's directly inside the block with overflow (top two examples).
Created attachment 4912 [details] testcase
This is wrong in shipping Safari also, but it's differently wrong. :)
Created attachment 4913 [details] suggested patch
Created attachment 4914 [details] suggested patch
Comment on attachment 4914 [details] suggested patch This looks like a really great fix to me. However, I think that containingBlock() can be a relatively complicated calculation, so it should be put in a local variable since we're using it three times in a row.
Created attachment 4918 [details] revised patch
Comment on attachment 4918 [details] revised patch Put containingBlock() into a local variable as Darin suggested.
I've committed this.