In attachment 5911 [details], when you click Grow, there's an area that doesn't repaint, leaving behind a blue line. Switch to another tab to force repaint. The Grow button eventually changes the cell's extra bottom, but when it repaints (during layout), it still has its old, smaller extra bottom, so it doesn't repaint any of the new area it will occupy. Most of that area is new to the table, so it gets painted by the table, but the blue area was already in the table and hence isn't repainted. I'm going to attach another testcase, which is not a regression, where the table doesn't grow, and therefore nothing gets repainted.
Created attachment 5925 [details] Other testcase
It's an obvious coding mistake in JSAbstractEventListener::handleEvent.
(In reply to comment #2) > It's an obvious coding mistake in JSAbstractEventListener::handleEvent. Oops, that was a comment for another bug!
See also bug 7111.
Attachment 5911 [details] seems to be a regression but not attachment 5925 [details] <rdar://problem/4483819>
Created attachment 7801 [details] Patch, including change log and manual test
I'll need time to study this one. :)
Fixing bug 8449 made this bug appear also in manual-tests/left-overflow-repaint.html Test 3.
Looks good to me, but Hyatt said a week ago that he wants to look it over, so we should wait for him to review.
Created attachment 8003 [details] Updated patch, now with automated test Corrected one mistake which Hyatt pointed out on IRC and changed the manual test into an automated one (which requires repaint.js from the patch in bug 8607).
Comment on attachment 8003 [details] Updated patch, now with automated test r=me (with trepidation!)
*** Bug 7111 has been marked as a duplicate of this bug. ***