Bug 5826 added some code in RenderLayer that adds a m_scrollLeftOverflow member variable for some RTL issues. So RL now has scrollXOffset/scrollYOffset and addScrollOffset/subtractScrollOffset (which got renamed via bug 21941). Only the latter methods take m_scrollLeftOverflow into account, but hyatt thinks that m_scrollLeftOverflow is always equal to -m_scrollX. This needs cleaning up, with any special-case RTL stuff kept internal to RenderLayer.