diff --git a/mozilla/layout/base/nsCSSFrameConstructor.cpp b/mozilla/layout/base/nsCSSFrameConstructor.cpp
index 2644767fea5..cf3761001a6 100644
--- a/mozilla/layout/base/nsCSSFrameConstructor.cpp
+++ b/mozilla/layout/base/nsCSSFrameConstructor.cpp
@@ -9800,8 +9800,8 @@ nsCSSFrameConstructor::StyleChangeReflow(nsIFrame* aFrame,
   if (IsFrameSpecial(aFrame))
     aFrame = GetIBContainingBlockFor(aFrame);
 
-  aFrame->AddStateBits(NS_FRAME_IS_DIRTY);
-  mPresShell->FrameNeedsReflow(aFrame, nsIPresShell::eStyleChange);
+  mPresShell->FrameNeedsReflow(aFrame, nsIPresShell::eStyleChange,
+                               NS_FRAME_IS_DIRTY);
 
   return NS_OK;
 }
diff --git a/mozilla/layout/base/nsIPresShell.h b/mozilla/layout/base/nsIPresShell.h
index d524aed5f1f..c17e8f84a41 100644
--- a/mozilla/layout/base/nsIPresShell.h
+++ b/mozilla/layout/base/nsIPresShell.h
@@ -99,6 +99,7 @@ class nsIScrollableFrame;
 class gfxASurface;
 
 typedef short SelectionType;
+typedef PRUint32 nsFrameState;
 
 // DC543B71-6F1A-4B9F-B4CF-693AEC4BA24A
 #define NS_IPRESSHELL_IID \
@@ -341,10 +342,11 @@ public:
                                     nsIFrame** aPlaceholderFrame) const = 0;
 
   /**
-   * Tell the pres shell that a frame is dirty (as indicated by bits)
-   * and needs Reflow.  It's OK if this is an ancestor of the frame needing
-   * reflow as long as the ancestor chain between them doesn't cross a reflow
-   * root.
+   * Tell the pres shell that a frame needs to be marked dirty and needs
+   * Reflow.  It's OK if this is an ancestor of the frame needing reflow as
+   * long as the ancestor chain between them doesn't cross a reflow root.  The
+   * bits to add should be some combination of NS_FRAME_IS_DIRTY and
+   * NS_FRAME_HAS_DIRTY_CHILDREN.
    */
   enum IntrinsicDirty {
     // XXXldb eResize should be renamed
@@ -353,7 +355,8 @@ public:
     eStyleChange // Do eTreeChange, plus all of aFrame's descendants
   };
   NS_IMETHOD FrameNeedsReflow(nsIFrame *aFrame,
-                              IntrinsicDirty aIntrinsicDirty) = 0;
+                              IntrinsicDirty aIntrinsicDirty,
+                              nsFrameState aBitsToAdd) = 0;
 
   NS_IMETHOD CancelAllPendingReflows() = 0;
 
diff --git a/mozilla/layout/base/nsPresShell.cpp b/mozilla/layout/base/nsPresShell.cpp
index 16ee0712569..884fa57eb5f 100644
--- a/mozilla/layout/base/nsPresShell.cpp
+++ b/mozilla/layout/base/nsPresShell.cpp
@@ -812,7 +812,8 @@ public:
                                 nsISupports** aResult) const;
   NS_IMETHOD GetPlaceholderFrameFor(nsIFrame*  aFrame,
                                     nsIFrame** aPlaceholderFrame) const;
-  NS_IMETHOD FrameNeedsReflow(nsIFrame *aFrame, IntrinsicDirty aIntrinsicDirty);
+  NS_IMETHOD FrameNeedsReflow(nsIFrame *aFrame, IntrinsicDirty aIntrinsicDirty,
+                              nsFrameState aBitsToAdd);
   NS_IMETHOD CancelAllPendingReflows();
   NS_IMETHOD IsSafeToFlush(PRBool& aIsSafeToFlush);
   NS_IMETHOD FlushPendingNotifications(mozFlushType aType);
@@ -2462,9 +2463,18 @@ PresShell::InitialReflow(nscoord aWidth, nscoord aHeight)
   }
 
   if (rootFrame) {
-    rootFrame->AddStateBits(NS_FRAME_IS_DIRTY);
-    FrameNeedsReflow(rootFrame, eResize);
-    mDirtyRoots.AppendElement(rootFrame);
+    // Note: Because the frame just got created, it has the NS_FRAME_IS_DIRTY
+    // bit set.  Unset it so that FrameNeedsReflow() will work right.
+    NS_ASSERTION(mDirtyRoots.IndexOf(rootFrame) == -1,
+                 "Why is the root in mDirtyRoots already?");
+
+    rootFrame->RemoveStateBits(NS_FRAME_IS_DIRTY |
+                               NS_FRAME_HAS_DIRTY_CHILDREN);
+    FrameNeedsReflow(rootFrame, eResize, NS_FRAME_IS_DIRTY);
+
+    NS_ASSERTION(mDirtyRoots.IndexOf(rootFrame) != -1,
+                 "Should be in mDirtyRoots now");
+    NS_ASSERTION(mReflowEvent.IsPending(), "Why no reflow event pending?");
   }
 
   // Restore our root scroll position now if we're getting here after EndLoad
@@ -2932,13 +2942,7 @@ PresShell::StyleChangeReflow()
   if (!rootFrame)
     return NS_OK;
 
-  if (!(rootFrame->GetStateBits() &
-        (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN))) {
-    rootFrame->AddStateBits(NS_FRAME_IS_DIRTY);
-    mDirtyRoots.AppendElement(rootFrame);
-  }
-
-  return FrameNeedsReflow(rootFrame, eStyleChange);
+  return FrameNeedsReflow(rootFrame, eStyleChange, NS_FRAME_IS_DIRTY);
 }
 
 nsIFrame*
@@ -3109,11 +3113,12 @@ PresShell::VerifyHasDirtyRootAncestor(nsIFrame* aFrame)
 #endif
 
 NS_IMETHODIMP
-PresShell::FrameNeedsReflow(nsIFrame *aFrame, IntrinsicDirty aIntrinsicDirty)
+PresShell::FrameNeedsReflow(nsIFrame *aFrame, IntrinsicDirty aIntrinsicDirty,
+                            nsFrameState aBitsToAdd)
 {
-  NS_PRECONDITION(aFrame->GetStateBits() &
-                    (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN),
-                  "frame not dirty");
+  NS_PRECONDITION(aBitsToAdd == NS_FRAME_IS_DIRTY ||
+                  aBitsToAdd == NS_FRAME_HAS_DIRTY_CHILDREN,
+                  "Unexpected bits being added");
 
   // XXX Add this assertion at some point!?  nsSliderFrame triggers it a lot.
   //NS_ASSERTION(!mIsReflowing, "can't mark frame dirty during reflow");
@@ -3144,14 +3149,25 @@ PresShell::FrameNeedsReflow(nsIFrame *aFrame, IntrinsicDirty aIntrinsicDirty)
   }  
 #endif
 
+  // Grab |wasDirty| now so we can go ahead and update the bits on
+  // aFrame and then get |targetFrameDirty|.
+  PRBool wasDirty = NS_SUBTREE_DIRTY(aFrame);
+  aFrame->AddStateBits(aBitsToAdd);
+  PRBool targetFrameDirty = ((aFrame->GetStateBits() & NS_FRAME_IS_DIRTY) != 0);
+#define FRAME_IS_REFLOW_ROOT(_f)                   \
+  ((_f->GetStateBits() & NS_FRAME_REFLOW_ROOT) &&  \
+   (_f != aFrame || !targetFrameDirty))
+
+
   // Mark the intrinsic widths as dirty on the frame, all of its ancestors,
   // and all of its descendants, if needed:
 
   if (aIntrinsicDirty != eResize) {
-    // Mark argument and all ancestors dirty (unless we hit a reflow root
-    // other than aFrame)
+    // Mark argument and all ancestors dirty. (Unless we hit a reflow root that
+    // should contain the reflow.  That root could be aFrame itself if it's not
+    // dirty, or it could be some ancestor of aFrame.)
     for (nsIFrame *a = aFrame;
-         a && (!(a->GetStateBits() & NS_FRAME_REFLOW_ROOT) || a == aFrame);
+         a && !FRAME_IS_REFLOW_ROOT(a);
          a = a->GetParent())
       a->MarkIntrinsicWidthsDirty();
   }
@@ -3183,10 +3199,8 @@ PresShell::FrameNeedsReflow(nsIFrame *aFrame, IntrinsicDirty aIntrinsicDirty)
   // Set NS_FRAME_HAS_DIRTY_CHILDREN bits (via nsIFrame::ChildIsDirty) up the
   // tree until we reach either a frame that's already dirty or a reflow root.
   nsIFrame *f = aFrame;
-  PRBool wasDirty = PR_TRUE;
   for (;;) {
-    if (((f->GetStateBits() & NS_FRAME_REFLOW_ROOT) && f != aFrame) ||
-        !f->GetParent()) {
+    if (FRAME_IS_REFLOW_ROOT(f) || !f->GetParent()) {
       // we've hit a reflow root or the root frame
       if (!wasDirty) {
         // Remove existing entries so we don't get duplicates,
@@ -3207,8 +3221,7 @@ PresShell::FrameNeedsReflow(nsIFrame *aFrame, IntrinsicDirty aIntrinsicDirty)
 
     nsIFrame *child = f;
     f = f->GetParent();
-    wasDirty = ((f->GetStateBits() & 
-                 (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) != 0);
+    wasDirty = NS_SUBTREE_DIRTY(f);
     f->ChildIsDirty(child);
     NS_ASSERTION(f->GetStateBits() & NS_FRAME_HAS_DIRTY_CHILDREN,
                  "ChildIsDirty didn't do its job");
@@ -6139,8 +6152,7 @@ PresShell::ProcessReflowCommands(PRBool aInterruptible)
         nsIFrame *target = NS_STATIC_CAST(nsIFrame*, mDirtyRoots[idx]);
         mDirtyRoots.RemoveElementAt(idx);
 
-        if (!(target->GetStateBits() &
-              (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN))) {
+        if (!NS_SUBTREE_DIRTY(target)) {
           // It's not dirty anymore, which probably means the notification
           // was posted in the middle of a reflow (perhaps with a reflow
           // root in the middle).  Don't do anything.
diff --git a/mozilla/layout/forms/nsComboboxControlFrame.cpp b/mozilla/layout/forms/nsComboboxControlFrame.cpp
index ac342cb320a..840110ad3c8 100644
--- a/mozilla/layout/forms/nsComboboxControlFrame.cpp
+++ b/mozilla/layout/forms/nsComboboxControlFrame.cpp
@@ -447,8 +447,7 @@ nsComboboxControlFrame::ReflowDropdown(nsPresContext*  aPresContext,
   // don't even need to cache mDropdownFrame's ascent or anything.  If we don't
   // need to reflow it, just bail out here.
   if (!aReflowState.ShouldReflowAllKids() &&
-      !(mDropdownFrame->GetStateBits() & (NS_FRAME_IS_DIRTY |
-                                          NS_FRAME_HAS_DIRTY_CHILDREN))) {
+      !NS_SUBTREE_DIRTY(mDropdownFrame)) {
     return NS_OK;
   }
 
@@ -828,10 +827,10 @@ nsComboboxControlFrame::HandleRedisplayTextEvent()
   mRedisplayTextEvent.Forget();
 
   ActuallyDisplayText(PR_TRUE);
-  mDisplayFrame->AddStateBits(NS_FRAME_IS_DIRTY);
   // XXXbz This should perhaps be eResize.  Check.
   PresContext()->PresShell()->FrameNeedsReflow(mDisplayFrame,
-                                                  nsIPresShell::eStyleChange);
+                                               nsIPresShell::eStyleChange,
+                                               NS_FRAME_IS_DIRTY);
 
   mInRedisplayText = PR_FALSE;
 }
diff --git a/mozilla/layout/forms/nsFieldSetFrame.cpp b/mozilla/layout/forms/nsFieldSetFrame.cpp
index df90aac5096..43ae052f045 100644
--- a/mozilla/layout/forms/nsFieldSetFrame.cpp
+++ b/mozilla/layout/forms/nsFieldSetFrame.cpp
@@ -459,13 +459,9 @@ nsFieldSetFrame::Reflow(nsPresContext*           aPresContext,
     reflowContent = mContentFrame != nsnull;
     reflowLegend = mLegendFrame != nsnull;
   } else {
-    reflowContent = mContentFrame &&
-      (mContentFrame->GetStateBits() &
-       (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) != 0;
+    reflowContent = mContentFrame && NS_SUBTREE_DIRTY(mContentFrame);
 
-    reflowLegend = mLegendFrame &&
-      (mLegendFrame->GetStateBits() &
-       (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) != 0;
+    reflowLegend = mLegendFrame && NS_SUBTREE_DIRTY(mLegendFrame);
   }
 
   nsSize availSize(aReflowState.ComputedWidth(), aReflowState.availableHeight);
@@ -699,9 +695,8 @@ nsFieldSetFrame::RemoveFrame(nsIAtom*       aListName,
 
     mFrames.DestroyFrame(mLegendFrame);
     mLegendFrame = nsnull;
-    AddStateBits(NS_FRAME_IS_DIRTY);
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+      FrameNeedsReflow(this, nsIPresShell::eTreeChange, NS_FRAME_IS_DIRTY);
     return NS_OK;
   }
   return mContentFrame->RemoveFrame(aListName, aOldFrame);
@@ -729,9 +724,9 @@ nsFieldSetFrame::MaybeSetLegend(nsIFrame* aFrameList, nsIAtom* aListName)
     aFrameList = mLegendFrame->GetNextSibling();
     mLegendFrame->SetNextSibling(mContentFrame);
     mFrames.SetFrames(mLegendFrame);
-    AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+      FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                       NS_FRAME_HAS_DIRTY_CHILDREN);
   }
   return aFrameList;
 }
diff --git a/mozilla/layout/forms/nsHTMLButtonControlFrame.cpp b/mozilla/layout/forms/nsHTMLButtonControlFrame.cpp
index b90126f3af5..31c45c5e541 100644
--- a/mozilla/layout/forms/nsHTMLButtonControlFrame.cpp
+++ b/mozilla/layout/forms/nsHTMLButtonControlFrame.cpp
@@ -293,8 +293,7 @@ nsHTMLButtonControlFrame::Reflow(nsPresContext* aPresContext,
 
   // XXXbz Eventually we may want to check-and-bail if
   // !aReflowState.ShouldReflowAllKids() &&
-  // !(firstKid->GetStateBits() &
-  //   (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)).
+  // !NS_SUBTREE_DIRTY(firstKid).
   // We'd need to cache our ascent for that, of course.
   
   nsMargin focusPadding = mRenderer.GetAddedButtonBorderAndPadding();
diff --git a/mozilla/layout/forms/nsListControlFrame.cpp b/mozilla/layout/forms/nsListControlFrame.cpp
index 8f3493fd649..c9b680f882e 100644
--- a/mozilla/layout/forms/nsListControlFrame.cpp
+++ b/mozilla/layout/forms/nsListControlFrame.cpp
@@ -567,8 +567,7 @@ nsListControlFrame::Reflow(nsPresContext*           aPresContext,
 
   PRBool autoHeight = (aReflowState.mComputedHeight == NS_UNCONSTRAINEDSIZE);
 
-  mMightNeedSecondPass = autoHeight &&
-    (GetStateBits() & (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN));
+  mMightNeedSecondPass = autoHeight && NS_SUBTREE_DIRTY(this);
   
   nsHTMLReflowState state(aReflowState);
   PRInt32 length = GetNumberOfOptions();  
@@ -636,8 +635,7 @@ nsListControlFrame::ReflowAsDropdown(nsPresContext*           aPresContext,
   NS_PRECONDITION(aReflowState.mComputedHeight == NS_UNCONSTRAINEDSIZE,
                   "We should not have a computed height here!");
   
-  mMightNeedSecondPass =
-    (GetStateBits() & (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) != 0;
+  mMightNeedSecondPass = NS_SUBTREE_DIRTY(this);
 
   nscoord oldHeightOfARow = HeightOfARow();
 
diff --git a/mozilla/layout/generic/nsAbsoluteContainingBlock.cpp b/mozilla/layout/generic/nsAbsoluteContainingBlock.cpp
index aaae4a4887c..f2959cbb110 100644
--- a/mozilla/layout/generic/nsAbsoluteContainingBlock.cpp
+++ b/mozilla/layout/generic/nsAbsoluteContainingBlock.cpp
@@ -88,11 +88,11 @@ nsAbsoluteContainingBlock::AppendFrames(nsIFrame*      aDelegatingFrame,
 #endif
   mAbsoluteFrames.AppendFrames(nsnull, aFrameList);
 
-  aDelegatingFrame->AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
   // no damage to intrinsic widths, since absolutely positioned frames can't
   // change them
   return aDelegatingFrame->PresContext()->PresShell()->
-    FrameNeedsReflow(aDelegatingFrame, nsIPresShell::eResize);
+    FrameNeedsReflow(aDelegatingFrame, nsIPresShell::eResize,
+                     NS_FRAME_HAS_DIRTY_CHILDREN);
 }
 
 nsresult
@@ -110,11 +110,11 @@ nsAbsoluteContainingBlock::InsertFrames(nsIFrame*      aDelegatingFrame,
 #endif
   mAbsoluteFrames.InsertFrames(nsnull, aPrevFrame, aFrameList);
 
-  aDelegatingFrame->AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
   // no damage to intrinsic widths, since absolutely positioned frames can't
   // change them
   return aDelegatingFrame->PresContext()->PresShell()->
-    FrameNeedsReflow(aDelegatingFrame, nsIPresShell::eResize);
+    FrameNeedsReflow(aDelegatingFrame, nsIPresShell::eResize,
+                     NS_FRAME_HAS_DIRTY_CHILDREN);
 }
 
 nsresult
@@ -170,8 +170,7 @@ nsAbsoluteContainingBlock::Reflow(nsIFrame*                aDelegatingFrame,
   nsIFrame* kidFrame;
   for (kidFrame = mAbsoluteFrames.FirstChild(); kidFrame; kidFrame = kidFrame->GetNextSibling()) {
     if (reflowAll ||
-        (kidFrame->GetStateBits() &
-           (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) ||
+        NS_SUBTREE_DIRTY(kidFrame) ||
         FrameDependsOnContainer(kidFrame, aCBWidthChanged, aCBHeightChanged)) {
       // Reflow the frame
       nsReflowStatus  kidStatus;
diff --git a/mozilla/layout/generic/nsBlockFrame.cpp b/mozilla/layout/generic/nsBlockFrame.cpp
index c263fca3bf3..727400badf1 100644
--- a/mozilla/layout/generic/nsBlockFrame.cpp
+++ b/mozilla/layout/generic/nsBlockFrame.cpp
@@ -517,9 +517,7 @@ nsBlockFrame::InvalidateInternal(const nsRect& aDamageRect,
 nscoord
 nsBlockFrame::GetBaseline() const
 {
-  NS_ASSERTION(!(GetStateBits() & (NS_FRAME_IS_DIRTY |
-                                   NS_FRAME_HAS_DIRTY_CHILDREN)),
-               "frame must not be dirty");
+  NS_ASSERTION(!NS_SUBTREE_DIRTY(this), "frame must not be dirty");
   nscoord result;
   if (nsLayoutUtils::GetLastLineBaseline(this, &result))
     return result;
@@ -890,7 +888,9 @@ nsBlockFrame::Reflow(nsPresContext*          aPresContext,
   }
 #endif // IBMBIDI
 
-  RenumberLists(aPresContext);
+  if (RenumberLists(aPresContext)) {
+    AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
+  }
 
   nsresult rv = NS_OK;
 
@@ -2428,10 +2428,11 @@ nsBlockFrame::AttributeChanged(PRInt32         aNameSpaceID,
     nsPresContext* presContext = PresContext();
 
     // XXX Not sure if this is necessary anymore
-    RenumberLists(presContext);
-
-    presContext->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eStyleChange);
+    if (RenumberLists(presContext)) {
+      presContext->PresShell()->
+        FrameNeedsReflow(this, nsIPresShell::eStyleChange,
+                         NS_FRAME_HAS_DIRTY_CHILDREN);
+    }
   }
   else if (nsGkAtoms::value == aAttribute) {
     const nsStyleDisplay* styleDisplay = GetStyleDisplay();
@@ -2447,10 +2448,11 @@ nsBlockFrame::AttributeChanged(PRInt32         aNameSpaceID,
       if (nsnull != blockParent) {
         nsPresContext* presContext = PresContext();
         // XXX Not sure if this is necessary anymore
-        blockParent->RenumberLists(presContext);
-
-        presContext->PresShell()->
-          FrameNeedsReflow(blockParent, nsIPresShell::eStyleChange);
+        if (blockParent->RenumberLists(presContext)) {
+          presContext->PresShell()->
+            FrameNeedsReflow(blockParent, nsIPresShell::eStyleChange,
+                             NS_FRAME_HAS_DIRTY_CHILDREN);
+        }
       }
     }
   }
@@ -4578,9 +4580,9 @@ nsBlockFrame::AppendFrames(nsIAtom*  aListName,
 #endif
   nsresult rv = AddFrames(aFrameList, lastKid);
   if (NS_SUCCEEDED(rv)) {
-    AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN); // XXX sufficient?
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+      FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                       NS_FRAME_HAS_DIRTY_CHILDREN); // XXX sufficient?
   }
   return rv;
 }
@@ -4626,9 +4628,9 @@ nsBlockFrame::InsertFrames(nsIAtom*  aListName,
   if (aListName != nsGkAtoms::nextBidi)
 #endif // IBMBIDI
   if (NS_SUCCEEDED(rv)) {
-    AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN); // XXX sufficient?
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+      FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                       NS_FRAME_HAS_DIRTY_CHILDREN); // XXX sufficient?
   }
   return rv;
 }
@@ -4901,9 +4903,9 @@ nsBlockFrame::RemoveFrame(nsIAtom*  aListName,
   }
 
   if (NS_SUCCEEDED(rv)) {
-    AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN); // XXX sufficient?
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+      FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                       NS_FRAME_HAS_DIRTY_CHILDREN); // XXX sufficient?
   }
   return rv;
 }
@@ -6038,13 +6040,13 @@ nsBlockFrame::FrameStartsCounterScope(nsIFrame* aFrame)
          localName == nsGkAtoms::menu;
 }
 
-void
+PRBool
 nsBlockFrame::RenumberLists(nsPresContext* aPresContext)
 {
   if (!FrameStartsCounterScope(this)) {
     // If this frame doesn't start a counter scope then we don't need
     // to renumber child list items.
-    return;
+    return PR_FALSE;
   }
 
   // Setup initial list ordinal value
@@ -6062,8 +6064,7 @@ nsBlockFrame::RenumberLists(nsPresContext* aPresContext)
 
   // Get to first-in-flow
   nsBlockFrame* block = (nsBlockFrame*) GetFirstInFlow();
-  if (RenumberListsInBlock(aPresContext, block, &ordinal, 0))
-    AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
+  return RenumberListsInBlock(aPresContext, block, &ordinal, 0);
 }
 
 PRBool
diff --git a/mozilla/layout/generic/nsBlockFrame.h b/mozilla/layout/generic/nsBlockFrame.h
index 74b16a7de86..f96d99a6c3a 100644
--- a/mozilla/layout/generic/nsBlockFrame.h
+++ b/mozilla/layout/generic/nsBlockFrame.h
@@ -522,7 +522,11 @@ protected:
   //----------------------------------------
   // List handling kludge
 
-  void RenumberLists(nsPresContext* aPresContext);
+  // If this returns PR_TRUE, the block it's called on should get the
+  // NS_FRAME_HAS_DIRTY_CHILDREN bit set on it by the caller; either directly
+  // if it's already in reflow, or via calling FrameNeedsReflow() to schedule a
+  // reflow.
+  PRBool RenumberLists(nsPresContext* aPresContext);
 
   PRBool RenumberListsInBlock(nsPresContext* aPresContext,
                               nsBlockFrame* aContainerFrame,
diff --git a/mozilla/layout/generic/nsBulletFrame.cpp b/mozilla/layout/generic/nsBulletFrame.cpp
index 6b08a4e6905..05145e34bfc 100644
--- a/mozilla/layout/generic/nsBulletFrame.cpp
+++ b/mozilla/layout/generic/nsBulletFrame.cpp
@@ -1615,11 +1615,8 @@ NS_IMETHODIMP nsBulletFrame::OnStartContainer(imgIRequest *aRequest,
     // a reflow of the bullet frame.
     nsIPresShell *shell = presContext->GetPresShell();
     if (shell) {
-      NS_ASSERTION(mParent, "No parent to pass the reflow request up to.");
-      if (mParent) {
-        mState |= NS_FRAME_IS_DIRTY;
-        shell->FrameNeedsReflow(this, nsIPresShell::eStyleChange);
-      }
+      shell->FrameNeedsReflow(this, nsIPresShell::eStyleChange,
+                              NS_FRAME_IS_DIRTY);
     }
   }
 
diff --git a/mozilla/layout/generic/nsColumnSetFrame.cpp b/mozilla/layout/generic/nsColumnSetFrame.cpp
index 61c66db6870..291ddd259b7 100644
--- a/mozilla/layout/generic/nsColumnSetFrame.cpp
+++ b/mozilla/layout/generic/nsColumnSetFrame.cpp
@@ -335,7 +335,7 @@ nsColumnSetFrame::ReflowChildren(nsHTMLReflowMetrics&     aDesiredSize,
                                  nsCollapsingMargin*      aBottomMarginCarriedOut) {
   PRBool allFit = PR_TRUE;
   PRBool RTL = GetStyleVisibility()->mDirection == NS_STYLE_DIRECTION_RTL;
-  PRBool shrinkingHeightOnly = !(GetStateBits() & (NS_FRAME_IS_DIRTY|NS_FRAME_HAS_DIRTY_CHILDREN)) &&
+  PRBool shrinkingHeightOnly = !NS_SUBTREE_DIRTY(this) &&
     mLastBalanceHeight > aConfig.mColMaxHeight;
   
 #ifdef DEBUG_roc
diff --git a/mozilla/layout/generic/nsContainerFrame.cpp b/mozilla/layout/generic/nsContainerFrame.cpp
index 07cb3aaff24..816aaacee79 100644
--- a/mozilla/layout/generic/nsContainerFrame.cpp
+++ b/mozilla/layout/generic/nsContainerFrame.cpp
@@ -138,9 +138,8 @@ nsContainerFrame::AppendFrames(nsIAtom*  aListName,
     if (nsnull == aListName)
 #endif
     {
-      AddStateBits(NS_FRAME_IS_DIRTY);
       PresContext()->PresShell()->
-        FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+        FrameNeedsReflow(this, nsIPresShell::eTreeChange, NS_FRAME_IS_DIRTY);
     }
   }
   return NS_OK;
@@ -171,10 +170,8 @@ nsContainerFrame::InsertFrames(nsIAtom*  aListName,
     if (nsnull == aListName)
 #endif
     {
-      // Ask the parent frame to reflow me.
-      AddStateBits(NS_FRAME_IS_DIRTY);
       PresContext()->PresShell()->
-        FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+        FrameNeedsReflow(this, nsIPresShell::eTreeChange, NS_FRAME_IS_DIRTY);
     }
   }
   return NS_OK;
@@ -229,10 +226,8 @@ nsContainerFrame::RemoveFrame(nsIAtom*  aListName,
     }
 
     if (generateReflowCommand) {
-      // Ask the parent frame to reflow me.
-      AddStateBits(NS_FRAME_IS_DIRTY);
       PresContext()->PresShell()->
-        FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+        FrameNeedsReflow(this, nsIPresShell::eTreeChange, NS_FRAME_IS_DIRTY);
     }
   }
 
diff --git a/mozilla/layout/generic/nsFrame.cpp b/mozilla/layout/generic/nsFrame.cpp
index a940a1e50a7..e47ecccd3df 100644
--- a/mozilla/layout/generic/nsFrame.cpp
+++ b/mozilla/layout/generic/nsFrame.cpp
@@ -688,8 +688,7 @@ NS_IMETHODIMP nsFrame::DidSetStyleContext()
 /* virtual */ nsMargin
 nsIFrame::GetUsedMargin() const
 {
-  NS_ASSERTION(!(GetStateBits() &
-                 (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) ||
+  NS_ASSERTION(!NS_SUBTREE_DIRTY(this) ||
                (GetStateBits() & NS_FRAME_IN_REFLOW),
                "cannot call on a dirty frame not currently being reflowed");
 
@@ -708,8 +707,7 @@ nsIFrame::GetUsedMargin() const
 /* virtual */ nsMargin
 nsIFrame::GetUsedBorder() const
 {
-  NS_ASSERTION(!(GetStateBits() &
-                 (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) ||
+  NS_ASSERTION(!NS_SUBTREE_DIRTY(this) ||
                (GetStateBits() & NS_FRAME_IN_REFLOW),
                "cannot call on a dirty frame not currently being reflowed");
 
@@ -736,8 +734,7 @@ nsIFrame::GetUsedBorder() const
 /* virtual */ nsMargin
 nsIFrame::GetUsedPadding() const
 {
-  NS_ASSERTION(!(GetStateBits() &
-                 (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) ||
+  NS_ASSERTION(!NS_SUBTREE_DIRTY(this) ||
                (GetStateBits() & NS_FRAME_IN_REFLOW),
                "cannot call on a dirty frame not currently being reflowed");
 
@@ -832,8 +829,7 @@ nsFrame::SetAdditionalStyleContext(PRInt32 aIndex,
 nscoord
 nsFrame::GetBaseline() const
 {
-  NS_ASSERTION(!(GetStateBits() & (NS_FRAME_IS_DIRTY |
-                                   NS_FRAME_HAS_DIRTY_CHILDREN)),
+  NS_ASSERTION(!NS_SUBTREE_DIRTY(this),
                "frame must not be dirty");
   // Default to the bottom margin edge, per CSS2.1's definition of the
   // 'baseline' value of 'vertical-align'.
@@ -6113,8 +6109,7 @@ nsFrame::BoxReflow(nsBoxLayoutState&        aState,
   PRBool redrawAfterReflow = PR_FALSE;
   PRBool redrawNow = PR_FALSE;
 
-  PRBool needsReflow =
-    (GetStateBits() & (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) != 0;
+  PRBool needsReflow = NS_SUBTREE_DIRTY(this);
 
   if (redrawNow)
      Redraw(aState);
diff --git a/mozilla/layout/generic/nsGfxScrollFrame.cpp b/mozilla/layout/generic/nsGfxScrollFrame.cpp
index daf7f4dcc39..c6dfde6a4d0 100644
--- a/mozilla/layout/generic/nsGfxScrollFrame.cpp
+++ b/mozilla/layout/generic/nsGfxScrollFrame.cpp
@@ -734,9 +734,7 @@ nsHTMLScrollFrame::Reflow(nsPresContext*           aPresContext,
   PRBool reflowScrollCorner = PR_TRUE;
   if (!aReflowState.ShouldReflowAllKids()) {
     #define NEEDS_REFLOW(frame_) \
-      ((frame_) && \
-       ((frame_)->GetStateBits() & \
-        (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) != 0)
+      ((frame_) && NS_SUBTREE_DIRTY(frame_))
 
     reflowContents = NEEDS_REFLOW(mInner.mScrolledFrame);
     reflowHScrollbar = NEEDS_REFLOW(mInner.mHScrollbarBox);
@@ -2488,10 +2486,10 @@ nsGfxScrollFrameInner::LayoutScrollbars(nsBoxLayoutState& aState,
            parentFrame->GetFirstChild(nsGkAtoms::fixedList);
          fixedChild; fixedChild = fixedChild->GetNextSibling()) {
       // force a reflow of the fixed child
-      fixedChild->AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
       // XXX Will this work given where we currently are in reflow?
       aState.PresContext()->PresShell()->
-        FrameNeedsReflow(fixedChild, nsIPresShell::eResize);
+        FrameNeedsReflow(fixedChild, nsIPresShell::eResize,
+                         NS_FRAME_HAS_DIRTY_CHILDREN);
     }
   }
   
diff --git a/mozilla/layout/generic/nsHTMLFrame.cpp b/mozilla/layout/generic/nsHTMLFrame.cpp
index 4b01a303d47..298b6d29f9b 100644
--- a/mozilla/layout/generic/nsHTMLFrame.cpp
+++ b/mozilla/layout/generic/nsHTMLFrame.cpp
@@ -282,7 +282,8 @@ CanvasFrame::AppendFrames(nsIAtom*        aListName,
     mFrames.AppendFrame(nsnull, aFrameList);
 
     rv = PresContext()->PresShell()->
-           FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+           FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                            NS_FRAME_HAS_DIRTY_CHILDREN);
   }
 
   return rv;
@@ -328,9 +329,9 @@ CanvasFrame::RemoveFrame(nsIAtom*        aListName,
     // Remove the frame and destroy it
     mFrames.DestroyFrame(aOldFrame);
 
-    AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
     rv = PresContext()->PresShell()->
-           FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+           FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                            NS_FRAME_HAS_DIRTY_CHILDREN);
   } else {
     rv = NS_ERROR_FAILURE;
   }
diff --git a/mozilla/layout/generic/nsHTMLReflowState.cpp b/mozilla/layout/generic/nsHTMLReflowState.cpp
index 27d8bb2f016..e46fab9c1f5 100644
--- a/mozilla/layout/generic/nsHTMLReflowState.cpp
+++ b/mozilla/layout/generic/nsHTMLReflowState.cpp
@@ -142,8 +142,7 @@ nsHTMLReflowState::nsHTMLReflowState(nsPresContext*           aPresContext,
   NS_PRECONDITION(aInit == PR_TRUE || aInit == PR_FALSE,
                   "aInit out of range for PRBool");
   NS_PRECONDITION(!mFlags.mSpecialHeightReflow ||
-                  !(aFrame->GetStateBits() & (NS_FRAME_IS_DIRTY |
-                                              NS_FRAME_HAS_DIRTY_CHILDREN)),
+                  !NS_SUBTREE_DIRTY(aFrame),
                   "frame should be clean when getting special height reflow");
 
   parentReflowState = &aParentReflowState;
@@ -339,9 +338,7 @@ nsHTMLReflowState::InitResizeFlags(nsPresContext* aPresContext)
       // XXX This condition doesn't quite match CalcQuirkContainingBlockHeight.
       mFlags.mVResize = mCBReflowState->mFlags.mVResize;
     } else {
-      mFlags.mVResize = mFlags.mHResize || 
-                        (frame->GetStateBits() &
-                         (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN));
+      mFlags.mVResize = mFlags.mHResize || NS_SUBTREE_DIRTY(frame); 
     }
   } else {
     // not 'auto' height
diff --git a/mozilla/layout/generic/nsIFrame.h b/mozilla/layout/generic/nsIFrame.h
index a0136944ed1..b680a54d9b0 100644
--- a/mozilla/layout/generic/nsIFrame.h
+++ b/mozilla/layout/generic/nsIFrame.h
@@ -187,6 +187,8 @@ typedef PRUint32 nsFrameState;
 // This bit is set when the frame is first created.
 // This bit is cleared by DidReflow after the required call to Reflow has
 // finished.
+// Do not set this bit yourself if you plan to pass the frame to
+// nsIPresShell::FrameNeedsReflow.  Pass the right arguments instead.
 #define NS_FRAME_IS_DIRTY                             0x00000400
 
 // If this bit is set then the frame is unflowable.
@@ -200,6 +202,8 @@ typedef PRUint32 nsFrameState;
 // do as much work as it would if NS_FRAME_IS_DIRTY were set.
 // This bit is cleared by DidReflow after the required call to Reflow has
 // finished.
+// Do not set this bit yourself if you plan to pass the frame to
+// nsIPresShell::FrameNeedsReflow.  Pass the right arguments instead.
 #define NS_FRAME_HAS_DIRTY_CHILDREN                   0x00001000
 
 // If this bit is set, the frame has an associated view
@@ -244,6 +248,11 @@ typedef PRUint32 nsFrameState;
 #define NS_STATE_IS_HORIZONTAL                        0x00400000
 #define NS_STATE_IS_DIRECTION_NORMAL                  0x80000000
 
+// Helper macros
+#define NS_SUBTREE_DIRTY(_frame)  \
+  (((_frame)->GetStateBits() &      \
+    (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) != 0)
+
 //----------------------------------------------------------------------
 
 enum nsSelectionAmount {
diff --git a/mozilla/layout/generic/nsImageFrame.cpp b/mozilla/layout/generic/nsImageFrame.cpp
index 4476d8db940..a033b1bd54b 100644
--- a/mozilla/layout/generic/nsImageFrame.cpp
+++ b/mozilla/layout/generic/nsImageFrame.cpp
@@ -532,12 +532,10 @@ nsImageFrame::OnStartContainer(imgIRequest *aRequest, imgIContainer *aImage)
   // already gotten the initial reflow
   if (!(mState & IMAGE_SIZECONSTRAINED) && (mState & IMAGE_GOTINITIALREFLOW)) { 
     nsIPresShell *presShell = presContext->GetPresShell();
-    NS_ASSERTION(mParent, "No parent to pass the reflow request up to.");
     NS_ASSERTION(presShell, "No PresShell.");
-    if (mParent && presShell) { 
-      AddStateBits(NS_FRAME_IS_DIRTY);
-      presShell->FrameNeedsReflow(NS_STATIC_CAST(nsIFrame*, this),
-                                  nsIPresShell::eStyleChange);
+    if (presShell) { 
+      presShell->FrameNeedsReflow(this, nsIPresShell::eStyleChange,
+                                  NS_FRAME_IS_DIRTY);
     }
   }
 
@@ -640,11 +638,9 @@ nsImageFrame::OnStopDecode(imgIRequest *aRequest,
 
     if (mState & IMAGE_GOTINITIALREFLOW) { // do nothing if we haven't gotten the initial reflow yet
       if (!(mState & IMAGE_SIZECONSTRAINED) && intrinsicSizeChanged) {
-        NS_ASSERTION(mParent, "No parent to pass the reflow request up to.");
-        if (mParent && presShell) { 
-          AddStateBits(NS_FRAME_IS_DIRTY);
-          presShell->FrameNeedsReflow(NS_STATIC_CAST(nsIFrame*, this),
-                                      nsIPresShell::eStyleChange);
+        if (presShell) { 
+          presShell->FrameNeedsReflow(this, nsIPresShell::eStyleChange,
+                                      NS_FRAME_IS_DIRTY);
         }
       } else {
         nsSize s = GetSize();
@@ -1577,10 +1573,9 @@ nsImageFrame::AttributeChanged(PRInt32 aNameSpaceID,
   }
   if (nsGkAtoms::alt == aAttribute)
   {
-    AddStateBits(NS_FRAME_IS_DIRTY);
-    PresContext()->PresShell()->FrameNeedsReflow(
-                                       NS_STATIC_CAST(nsIFrame*, this),
-                                       nsIPresShell::eStyleChange);
+    PresContext()->PresShell()->FrameNeedsReflow(this,
+                                                 nsIPresShell::eStyleChange,
+                                                 NS_FRAME_IS_DIRTY);
   }
 
   return NS_OK;
diff --git a/mozilla/layout/generic/nsLineLayout.cpp b/mozilla/layout/generic/nsLineLayout.cpp
index bda7fd5248a..1afa79b587f 100644
--- a/mozilla/layout/generic/nsLineLayout.cpp
+++ b/mozilla/layout/generic/nsLineLayout.cpp
@@ -914,8 +914,7 @@ nsLineLayout::ReflowFrame(nsIFrame* aFrame,
       if (outOfFlowFrame) {
         nsPlaceholderFrame* placeholder = NS_STATIC_CAST(nsPlaceholderFrame*, aFrame);
         // XXXldb What is this test supposed to be?
-        if (!(aFrame->GetStateBits() &
-              (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN))) {
+        if (!NS_SUBTREE_DIRTY(aFrame)) {
           // incremental reflow of child
           placedFloat = InitFloat(placeholder, aReflowStatus);
         }
diff --git a/mozilla/layout/generic/nsObjectFrame.cpp b/mozilla/layout/generic/nsObjectFrame.cpp
index 8b080446f2d..1ac71678ae0 100644
--- a/mozilla/layout/generic/nsObjectFrame.cpp
+++ b/mozilla/layout/generic/nsObjectFrame.cpp
@@ -755,9 +755,8 @@ nsObjectFrame::InstantiatePlugin(nsIPluginHost* aPluginHost,
 
   // XXX having to do this sucks. it'd be better to move the code from DidReflow
   // to FixupWindow or something.
-  AddStateBits(NS_FRAME_IS_DIRTY);
   PresContext()->GetPresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eStyleChange);
+    FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
   return rv;
 }
 
@@ -1321,7 +1320,7 @@ nsObjectFrame::Instantiate(nsIChannel* aChannel, nsIStreamListener** aStreamList
   // XXX having to do this sucks. it'd be better to move the code from DidReflow
   // to FixupWindow.
   PresContext()->GetPresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eStyleChange);
+    FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
   return rv;
 }
 
diff --git a/mozilla/layout/generic/nsTextFrame.cpp b/mozilla/layout/generic/nsTextFrame.cpp
index 1921bda3d79..602eb363761 100644
--- a/mozilla/layout/generic/nsTextFrame.cpp
+++ b/mozilla/layout/generic/nsTextFrame.cpp
@@ -1946,32 +1946,34 @@ nsTextFrame::CharacterDataChanged(nsPresContext* aPresContext,
 {
   nsIFrame* targetTextFrame = this;
 
-  PRBool markAllDirty = PR_TRUE;
   if (aAppend) {
-    markAllDirty = PR_FALSE;
-    nsTextFrame* frame = NS_STATIC_CAST(nsTextFrame*, GetLastInFlow());
+    nsTextFrame* frame = NS_STATIC_CAST(nsTextFrame*, GetLastContinuation());
     frame->mState &= ~TEXT_WHITESPACE_FLAGS;
-    frame->mState |= NS_FRAME_IS_DIRTY;
     targetTextFrame = frame;
-  }
-
-  if (markAllDirty) {
+  } else {
     // Mark this frame and all the next-in-flow frames as dirty and reset all
     // the content offsets and lengths to 0, since they no longer know what
     // content is ok to access.
+
+    // Don't set NS_FRAME_IS_DIRTY on |this|, since we call FrameNeedsReflow
+    // below.
     nsTextFrame*  textFrame = this;
-    while (textFrame) {
+    do {
       textFrame->mState &= ~TEXT_WHITESPACE_FLAGS;
-      textFrame->mState |= NS_FRAME_IS_DIRTY;
       textFrame->mContentOffset = 0;
       textFrame->mContentLength = 0;
       textFrame = NS_STATIC_CAST(nsTextFrame*, textFrame->GetNextContinuation());
-    }
+      if (!textFrame) {
+        break;
+      }
+      textFrame->mState |= NS_FRAME_IS_DIRTY;
+    } while (1);
   }
 
   // Ask the parent frame to reflow me.  
   aPresContext->GetPresShell()->FrameNeedsReflow(targetTextFrame,
-                                                 nsIPresShell::eStyleChange);
+                                                 nsIPresShell::eStyleChange,
+                                                 NS_FRAME_IS_DIRTY);
 
   return NS_OK;
 }
diff --git a/mozilla/layout/generic/nsTextFrameThebes.cpp b/mozilla/layout/generic/nsTextFrameThebes.cpp
index 26dc1515062..51a514fb682 100644
--- a/mozilla/layout/generic/nsTextFrameThebes.cpp
+++ b/mozilla/layout/generic/nsTextFrameThebes.cpp
@@ -3093,22 +3093,26 @@ nsTextFrame::CharacterDataChanged(nsPresContext* aPresContext,
   if (aAppend) {
     lastTextFrame = NS_STATIC_CAST(nsTextFrame*, GetLastContinuation());
     lastTextFrame->mState &= ~TEXT_WHITESPACE_FLAGS;
-    lastTextFrame->mState |= NS_FRAME_IS_DIRTY;
     targetTextFrame = lastTextFrame;
   } else {
-    // Mark this frame and all the continuation frames as dirty, and fix up
-    // mContentLengths to be valid
+    // Mark all the continuation frames as dirty, and fix up mContentLengths to
+    // be valid.
+    // Don't set NS_FRAME_IS_DIRTY on |this|, since we call FrameNeedsReflow
+    // below.
     nsTextFrame* textFrame = this;
     PRInt32 newLength = nodeLength;
     do {
       textFrame->mState &= ~TEXT_WHITESPACE_FLAGS;
-      textFrame->mState |= NS_FRAME_IS_DIRTY;
       // If the text node has shrunk, clip the frame contentlength as necessary
       textFrame->mContentLength = PR_MIN(mContentLength, newLength);
       newLength -= textFrame->mContentLength;
       lastTextFrame = textFrame;
       textFrame = NS_STATIC_CAST(nsTextFrame*, textFrame->GetNextContinuation());
-    } while (textFrame);
+      if (!textFrame) {
+        break;
+      }
+      textFrame->mState |= NS_FRAME_IS_DIRTY;
+    } while (1);
     targetTextFrame = this;
   }
   // Set the length of the last text frame in the chain (necessary if the node grew)
@@ -3116,7 +3120,8 @@ nsTextFrame::CharacterDataChanged(nsPresContext* aPresContext,
 
   // Ask the parent frame to reflow me.
   aPresContext->GetPresShell()->FrameNeedsReflow(targetTextFrame,
-                                                 nsIPresShell::eStyleChange);
+                                                 nsIPresShell::eStyleChange,
+                                                 NS_FRAME_IS_DIRTY);
 
   return NS_OK;
 }
diff --git a/mozilla/layout/generic/nsViewportFrame.cpp b/mozilla/layout/generic/nsViewportFrame.cpp
index 0bc69f94d43..c2dca8bdc3a 100644
--- a/mozilla/layout/generic/nsViewportFrame.cpp
+++ b/mozilla/layout/generic/nsViewportFrame.cpp
@@ -270,8 +270,7 @@ ViewportFrame::Reflow(nsPresContext*          aPresContext,
     // targeted at our one-and-only principal child frame.
     if (aReflowState.ShouldReflowAllKids() ||
         aReflowState.mFlags.mVResize ||
-        (mFrames.FirstChild()->GetStateBits() &
-         (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN))) {
+        NS_SUBTREE_DIRTY(mFrames.FirstChild())) {
       // Reflow our one-and-only principal child frame
       nsIFrame*           kidFrame = mFrames.FirstChild();
       nsHTMLReflowMetrics kidDesiredSize;
diff --git a/mozilla/layout/mathml/base/src/nsMathMLContainerFrame.cpp b/mozilla/layout/mathml/base/src/nsMathMLContainerFrame.cpp
index 2b09403c2c1..e2324eb27db 100644
--- a/mozilla/layout/mathml/base/src/nsMathMLContainerFrame.cpp
+++ b/mozilla/layout/mathml/base/src/nsMathMLContainerFrame.cpp
@@ -811,7 +811,8 @@ nsMathMLContainerFrame::RebuildAutomaticDataForChildren(nsIFrame* aParentFrame)
 }
 
 /* static */ nsresult
-nsMathMLContainerFrame::ReLayoutChildren(nsIFrame* aParentFrame)
+nsMathMLContainerFrame::ReLayoutChildren(nsIFrame* aParentFrame,
+                                         nsFrameState aBits)
 {
   if (!aParentFrame)
     return NS_OK;
@@ -843,7 +844,8 @@ nsMathMLContainerFrame::ReLayoutChildren(nsIFrame* aParentFrame)
     if (content->Tag() == nsGkAtoms::math)
       break;
 
-    // mark the frame dirty, and continue to climb up
+    // mark the frame dirty, and continue to climb up.  It's important that
+    // we're NOT doing this to the frame we plan to pass to FrameNeedsReflow()
     frame->AddStateBits(NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN);
 
     frame = parent;
@@ -875,7 +877,7 @@ nsMathMLContainerFrame::ReLayoutChildren(nsIFrame* aParentFrame)
     return NS_OK;
 
   return frame->PresContext()->PresShell()->
-           FrameNeedsReflow(frame, nsIPresShell::eStyleChange);
+    FrameNeedsReflow(frame, nsIPresShell::eStyleChange, aBits);
 }
 
 // There are precise rules governing children of a MathML frame,
@@ -893,13 +895,16 @@ nsMathMLContainerFrame::ChildListChanged(PRInt32 aModType)
     nsIFrame* parent = mParent;
     nsEmbellishData embellishData;
     for ( ; parent; frame = parent, parent = parent->GetParent()) {
-      frame->AddStateBits(NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN);
       GetEmbellishDataFrom(parent, embellishData);
       if (embellishData.coreFrame != mEmbellishData.coreFrame)
         break;
+
+      // Important: do not do this to the frame we plan to pass to
+      // ReLayoutChildren
+      frame->AddStateBits(NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN);
     }
   }
-  return ReLayoutChildren(frame);
+  return ReLayoutChildren(frame, NS_FRAME_IS_DIRTY);
 }
 
 NS_IMETHODIMP
@@ -957,7 +962,8 @@ nsMathMLContainerFrame::AttributeChanged(PRInt32         aNameSpaceID,
   // we can't check all of them here, play safe by requesting a reflow.
   // XXXldb This should only do work for attributes that cause changes!
   return PresContext()->PresShell()->
-           FrameNeedsReflow(this, nsIPresShell::eStyleChange);
+           FrameNeedsReflow(this, nsIPresShell::eStyleChange,
+                            NS_FRAME_IS_DIRTY);
 }
 
 nsresult 
diff --git a/mozilla/layout/mathml/base/src/nsMathMLContainerFrame.h b/mozilla/layout/mathml/base/src/nsMathMLContainerFrame.h
index 404ad03c3db..cf455af8eae 100644
--- a/mozilla/layout/mathml/base/src/nsMathMLContainerFrame.h
+++ b/mozilla/layout/mathml/base/src/nsMathMLContainerFrame.h
@@ -178,10 +178,10 @@ public:
   // 2. If the MathML frame class has cached automatic data that depends on
   //    the attribute:
   //    2a. If the automatic data to update resides only within the descendants,
-  //        we just re-layout them using ReLayoutChildren(aPresContext, this);
+  //        we just re-layout them using ReLayoutChildren(this);
   //        (e.g., this happens with <ms>).
   //    2b. If the automatic data to update affects us in some way, we ask our parent
-  //        to re-layout its children using ReLayoutChildren(aPresContext, mParent);
+  //        to re-layout its children using ReLayoutChildren(mParent);
   //        Therefore, there is an overhead here in that our siblings are re-laid
   //        too (e.g., this happens with <mstyle>, <munder>, <mover>, <munderover>). 
   NS_IMETHOD
@@ -301,8 +301,10 @@ public:
   // method re-builds the automatic data in the children -- not in the parent
   // frame itself (except for those particular operations that the parent frame
   // may do do its TransmitAutomaticData()). @see RebuildAutomaticDataForChildren
+  //
+  // aBits are the bits to pass to FrameNeedsReflow() when we call it.
   static nsresult
-  ReLayoutChildren(nsIFrame* aParentFrame);
+  ReLayoutChildren(nsIFrame* aParentFrame, nsFrameState aBits);
 
 protected:
   virtual PRIntn GetSkipSides() const { return 0; }
@@ -361,7 +363,8 @@ public:
   {
     NS_ASSERTION(!aListName, "internal error");
     nsresult rv = nsBlockFrame::AppendFrames(aListName, aFrameList);
-    nsMathMLContainerFrame::ReLayoutChildren(this);
+    nsMathMLContainerFrame::ReLayoutChildren(this,
+                                             NS_FRAME_HAS_DIRTY_CHILDREN);
     return rv;
   }
 
@@ -372,7 +375,8 @@ public:
   {
     NS_ASSERTION(!aListName, "internal error");
     nsresult rv = nsBlockFrame::InsertFrames(aListName, aPrevFrame, aFrameList);
-    nsMathMLContainerFrame::ReLayoutChildren(this);
+    nsMathMLContainerFrame::ReLayoutChildren(this,
+                                             NS_FRAME_HAS_DIRTY_CHILDREN);
     return rv;
   }
 
@@ -382,7 +386,8 @@ public:
   {
     NS_ASSERTION(!aListName, "internal error");
     nsresult rv = nsBlockFrame::RemoveFrame(aListName, aOldFrame);
-    nsMathMLContainerFrame::ReLayoutChildren(this);
+    nsMathMLContainerFrame::ReLayoutChildren(this,
+                                             NS_FRAME_HAS_DIRTY_CHILDREN);
     return rv;
   }
 
@@ -444,7 +449,8 @@ public:
   {
     NS_ASSERTION(!aListName, "internal error");
     nsresult rv = nsInlineFrame::AppendFrames(aListName, aFrameList);
-    nsMathMLContainerFrame::ReLayoutChildren(this);
+    nsMathMLContainerFrame::ReLayoutChildren(this,
+                                             NS_FRAME_HAS_DIRTY_CHILDREN);
     return rv;
   }
 
@@ -455,7 +461,8 @@ public:
   {
     NS_ASSERTION(!aListName, "internal error");
     nsresult rv = nsInlineFrame::InsertFrames(aListName, aPrevFrame, aFrameList);
-    nsMathMLContainerFrame::ReLayoutChildren(this);
+    nsMathMLContainerFrame::ReLayoutChildren(this,
+                                             NS_FRAME_HAS_DIRTY_CHILDREN);
     return rv;
   }
 
@@ -465,7 +472,8 @@ public:
   {
     NS_ASSERTION(!aListName, "internal error");
     nsresult rv = nsInlineFrame::RemoveFrame(aListName, aOldFrame);
-    nsMathMLContainerFrame::ReLayoutChildren(this);
+    nsMathMLContainerFrame::ReLayoutChildren(this,
+                                             NS_FRAME_HAS_DIRTY_CHILDREN);
     return rv;
   }
 
diff --git a/mozilla/layout/mathml/base/src/nsMathMLmactionFrame.cpp b/mozilla/layout/mathml/base/src/nsMathMLmactionFrame.cpp
index 1a49d75bc00..cc549d86d0b 100644
--- a/mozilla/layout/mathml/base/src/nsMathMLmactionFrame.cpp
+++ b/mozilla/layout/mathml/base/src/nsMathMLmactionFrame.cpp
@@ -1,3 +1,4 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
@@ -389,9 +390,9 @@ nsMathMLmactionFrame::MouseClick(nsIDOMEvent* aMouseEvent)
       mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::selection_, value, notify);
 
       // Now trigger a content-changed reflow...
-      mSelectedFrame->AddStateBits(NS_FRAME_IS_DIRTY);
       PresContext()->PresShell()->
-        FrameNeedsReflow(mSelectedFrame, nsIPresShell::eTreeChange);
+        FrameNeedsReflow(mSelectedFrame, nsIPresShell::eTreeChange,
+                         NS_FRAME_IS_DIRTY);
     }
   }
   else if (NS_MATHML_ACTION_TYPE_RESTYLE == mActionType) {
@@ -405,9 +406,9 @@ nsMathMLmactionFrame::MouseClick(nsIDOMEvent* aMouseEvent)
           node->SetAttribute(NS_LITERAL_STRING("actiontype"), mRestyle);
 
         // Trigger a style change reflow
-        mSelectedFrame->AddStateBits(NS_FRAME_IS_DIRTY);
         PresContext()->PresShell()->
-          FrameNeedsReflow(mSelectedFrame, nsIPresShell::eStyleChange);
+          FrameNeedsReflow(mSelectedFrame, nsIPresShell::eStyleChange,
+                           NS_FRAME_IS_DIRTY);
       }
     }
   }
diff --git a/mozilla/layout/mathml/base/src/nsMathMLmoFrame.cpp b/mozilla/layout/mathml/base/src/nsMathMLmoFrame.cpp
index 724a86f0190..6741176365b 100644
--- a/mozilla/layout/mathml/base/src/nsMathMLmoFrame.cpp
+++ b/mozilla/layout/mathml/base/src/nsMathMLmoFrame.cpp
@@ -1000,7 +1000,7 @@ nsMathMLmoFrame::AttributeChanged(PRInt32         aNameSpaceID,
     } while (embellishData.coreFrame == this);
 
     // we have automatic data to update in the children of the target frame
-    return ReLayoutChildren(target);
+    return ReLayoutChildren(target, NS_FRAME_IS_DIRTY);
   }
 
   return nsMathMLTokenFrame::
diff --git a/mozilla/layout/mathml/base/src/nsMathMLmoverFrame.cpp b/mozilla/layout/mathml/base/src/nsMathMLmoverFrame.cpp
index 23e49e4879e..ee22b21c3a2 100644
--- a/mozilla/layout/mathml/base/src/nsMathMLmoverFrame.cpp
+++ b/mozilla/layout/mathml/base/src/nsMathMLmoverFrame.cpp
@@ -74,7 +74,7 @@ nsMathMLmoverFrame::AttributeChanged(PRInt32         aNameSpaceID,
   if (nsGkAtoms::accent_ == aAttribute) {
     // When we have automatic data to update within ourselves, we ask our
     // parent to re-layout its children
-    return ReLayoutChildren(mParent);
+    return ReLayoutChildren(mParent, NS_FRAME_IS_DIRTY);
   }
 
   return nsMathMLContainerFrame::
diff --git a/mozilla/layout/mathml/base/src/nsMathMLmstyleFrame.cpp b/mozilla/layout/mathml/base/src/nsMathMLmstyleFrame.cpp
index b4902d7dcb3..0bc1e66e8fd 100644
--- a/mozilla/layout/mathml/base/src/nsMathMLmstyleFrame.cpp
+++ b/mozilla/layout/mathml/base/src/nsMathMLmstyleFrame.cpp
@@ -168,5 +168,5 @@ nsMathMLmstyleFrame::AttributeChanged(PRInt32         aNameSpaceID,
   // them in our subtree. However, our siblings will be re-laid too. We used
   // to have a more speedier but more verbose alternative that didn't re-layout
   // our siblings. See bug 114909 - attachment 67668.
-  return ReLayoutChildren(mParent);
+  return ReLayoutChildren(mParent, NS_FRAME_IS_DIRTY);
 }
diff --git a/mozilla/layout/mathml/base/src/nsMathMLmtableFrame.cpp b/mozilla/layout/mathml/base/src/nsMathMLmtableFrame.cpp
index f50cb365824..bbeb0761f8f 100644
--- a/mozilla/layout/mathml/base/src/nsMathMLmtableFrame.cpp
+++ b/mozilla/layout/mathml/base/src/nsMathMLmtableFrame.cpp
@@ -448,7 +448,7 @@ nsMathMLmtableOuterFrame::AttributeChanged(PRInt32  aNameSpaceID,
   // align - just need to issue a dirty (resize) reflow command
   if (aAttribute == nsGkAtoms::align) {
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eResize);
+      FrameNeedsReflow(this, nsIPresShell::eResize, NS_FRAME_IS_DIRTY);
     return NS_OK;
   }
 
@@ -458,8 +458,10 @@ nsMathMLmtableOuterFrame::AttributeChanged(PRInt32  aNameSpaceID,
   if (aAttribute == nsGkAtoms::displaystyle_) {
     nsMathMLContainerFrame::RebuildAutomaticDataForChildren(mParent);
     nsMathMLContainerFrame::PropagateScriptStyleFor(tableFrame, mPresentationData.scriptLevel);
+    // XXXbz I have no idea why this is reflowing the _parent_ instead of
+    // us...
     PresContext()->PresShell()->
-      FrameNeedsReflow(mParent, nsIPresShell::eStyleChange);
+      FrameNeedsReflow(mParent, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
     return NS_OK;
   }
 
diff --git a/mozilla/layout/mathml/base/src/nsMathMLmunderFrame.cpp b/mozilla/layout/mathml/base/src/nsMathMLmunderFrame.cpp
index f36f80b5ac3..c2e07e9603f 100644
--- a/mozilla/layout/mathml/base/src/nsMathMLmunderFrame.cpp
+++ b/mozilla/layout/mathml/base/src/nsMathMLmunderFrame.cpp
@@ -74,7 +74,7 @@ nsMathMLmunderFrame::AttributeChanged(PRInt32         aNameSpaceID,
   if (nsGkAtoms::accentunder_ == aAttribute) {
     // When we have automatic data to update within ourselves, we ask our
     // parent to re-layout its children
-    return ReLayoutChildren(mParent);
+    return ReLayoutChildren(mParent, NS_FRAME_IS_DIRTY);
   }
 
   return nsMathMLContainerFrame::
diff --git a/mozilla/layout/mathml/base/src/nsMathMLmunderoverFrame.cpp b/mozilla/layout/mathml/base/src/nsMathMLmunderoverFrame.cpp
index 324f34a8717..69ab989386a 100644
--- a/mozilla/layout/mathml/base/src/nsMathMLmunderoverFrame.cpp
+++ b/mozilla/layout/mathml/base/src/nsMathMLmunderoverFrame.cpp
@@ -75,7 +75,7 @@ nsMathMLmunderoverFrame::AttributeChanged(PRInt32         aNameSpaceID,
       nsGkAtoms::accentunder_ == aAttribute) {
     // When we have automatic data to update within ourselves, we ask our
     // parent to re-layout its children
-    return ReLayoutChildren(mParent);
+    return ReLayoutChildren(mParent, NS_FRAME_IS_DIRTY);
   }
 
   return nsMathMLContainerFrame::
diff --git a/mozilla/layout/svg/base/src/nsSVGForeignObjectFrame.cpp b/mozilla/layout/svg/base/src/nsSVGForeignObjectFrame.cpp
index ab079dfae03..8660cbf80e3 100644
--- a/mozilla/layout/svg/base/src/nsSVGForeignObjectFrame.cpp
+++ b/mozilla/layout/svg/base/src/nsSVGForeignObjectFrame.cpp
@@ -494,8 +494,7 @@ void nsSVGForeignObjectFrame::RequestReflow(nsIPresShell::IntrinsicDirty aType)
   if (!kid)
     return;
 
-  kid->AddStateBits(NS_FRAME_IS_DIRTY);
-  PresContext()->PresShell()->FrameNeedsReflow(kid, aType);
+  PresContext()->PresShell()->FrameNeedsReflow(kid, aType, NS_FRAME_IS_DIRTY);
 }
 
 void nsSVGForeignObjectFrame::UpdateGraphic()
diff --git a/mozilla/layout/svg/base/src/nsSVGOuterSVGFrame.cpp b/mozilla/layout/svg/base/src/nsSVGOuterSVGFrame.cpp
index f85bc182cd9..da8d73d801e 100644
--- a/mozilla/layout/svg/base/src/nsSVGOuterSVGFrame.cpp
+++ b/mozilla/layout/svg/base/src/nsSVGOuterSVGFrame.cpp
@@ -380,9 +380,8 @@ nsSVGOuterSVGFrame::AttributeChanged(PRInt32         aNameSpaceID,
   if (aNameSpaceID == kNameSpaceID_None &&
       !(GetStateBits() & NS_FRAME_FIRST_REFLOW) &&
       (aAttribute == nsGkAtoms::width || aAttribute == nsGkAtoms::height)) {
-    AddStateBits(NS_FRAME_IS_DIRTY);
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eStyleChange);
+      FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
   }
 
   return NS_OK;
@@ -637,7 +636,8 @@ void nsSVGOuterSVGFrame::InitiateReflow()
   mNeedsReflow = PR_FALSE;
   
   nsIPresShell* presShell = PresContext()->PresShell();
-  presShell->FrameNeedsReflow(this, nsIPresShell::eStyleChange);
+  presShell->FrameNeedsReflow(this, nsIPresShell::eStyleChange,
+                              NS_FRAME_IS_DIRTY);
   // XXXbz why is this synchronously flushing reflows, exactly?  If it
   // needs to, why is it not using the presshell's reflow batching
   // instead of hacking its own?
diff --git a/mozilla/layout/tables/nsTableColGroupFrame.cpp b/mozilla/layout/tables/nsTableColGroupFrame.cpp
index c2c68c2ade0..958b25b0a8b 100644
--- a/mozilla/layout/tables/nsTableColGroupFrame.cpp
+++ b/mozilla/layout/tables/nsTableColGroupFrame.cpp
@@ -269,9 +269,9 @@ nsTableColGroupFrame::InsertColsReflow(PRInt32         aColIndex,
   if (!tableFrame)
     return;
 
-  tableFrame->AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
   PresContext()->PresShell()->FrameNeedsReflow(tableFrame,
-                                                  nsIPresShell::eTreeChange);
+                                               nsIPresShell::eTreeChange,
+                                               NS_FRAME_HAS_DIRTY_CHILDREN);
 }
 
 void
@@ -301,9 +301,9 @@ nsTableColGroupFrame::RemoveChild(nsTableColFrame& aChild,
   if (!tableFrame)
     return;
 
-  tableFrame->AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
   PresContext()->PresShell()->FrameNeedsReflow(tableFrame,
-                                                  nsIPresShell::eTreeChange);
+                                               nsIPresShell::eTreeChange,
+                                               NS_FRAME_HAS_DIRTY_CHILDREN);
 }
 
 NS_IMETHODIMP
@@ -325,9 +325,9 @@ nsTableColGroupFrame::RemoveFrame(nsIAtom*        aListName,
 
     tableFrame->RemoveCol(this, colIndex, PR_TRUE, PR_TRUE);
 
-    tableFrame->AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
     PresContext()->PresShell()->FrameNeedsReflow(tableFrame,
-                                                    nsIPresShell::eTreeChange);
+                                                 nsIPresShell::eTreeChange,
+                                                 NS_FRAME_HAS_DIRTY_CHILDREN);
   }
   else {
     mFrames.DestroyFrame(aOldFrame);
diff --git a/mozilla/layout/tables/nsTableFrame.cpp b/mozilla/layout/tables/nsTableFrame.cpp
index ce9cf30e5ee..d4854c80f0f 100644
--- a/mozilla/layout/tables/nsTableFrame.cpp
+++ b/mozilla/layout/tables/nsTableFrame.cpp
@@ -412,11 +412,10 @@ void nsTableFrame::AttributeChangedFor(nsIFrame*       aFrame,
         cells.AppendElement(cellFrame);
         InsertCells(cells, rowIndex, colIndex - 1);
 
-        AddStateBits(NS_FRAME_IS_DIRTY);
         // XXX Should this use eStyleChange?  It currently doesn't need
         // to, but it might given more optimization.
-        PresContext()->PresShell()->FrameNeedsReflow(this,
-          nsIPresShell::eTreeChange);
+        PresContext()->PresShell()->
+          FrameNeedsReflow(this, nsIPresShell::eTreeChange, NS_FRAME_IS_DIRTY);
       }
     }
   }
@@ -1871,7 +1870,7 @@ NS_METHOD nsTableFrame::Reflow(nsPresContext*          aPresContext,
   // reflows with a constrained width.
   PRBool needToInitiateSpecialReflow =
     !!(GetStateBits() & NS_FRAME_CONTAINS_RELATIVE_HEIGHT);
-  if ((GetStateBits() & (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) ||
+  if (NS_SUBTREE_DIRTY(this) ||
       aReflowState.ShouldReflowAllKids() ||
       IsGeometryDirty() ||
       needToInitiateSpecialReflow) {
@@ -2258,9 +2257,8 @@ nsTableFrame::AppendFrames(nsIAtom*        aListName,
   printf("=== TableFrame::AppendFrames\n");
   Dump(PR_TRUE, PR_TRUE, PR_TRUE);
 #endif
-  AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
-  PresContext()->PresShell()->FrameNeedsReflow(this,
-                                                  nsIPresShell::eTreeChange);
+  PresContext()->PresShell()->FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                                               NS_FRAME_HAS_DIRTY_CHILDREN);
   SetGeometryDirty();
 
   return NS_OK;
@@ -2366,9 +2364,8 @@ nsTableFrame::InsertFrames(nsIAtom*        aListName,
     return NS_OK;
   }
 
-  AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
-  PresContext()->PresShell()->FrameNeedsReflow(this,
-                                                  nsIPresShell::eTreeChange);
+  PresContext()->PresShell()->FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                                               NS_FRAME_HAS_DIRTY_CHILDREN);
   SetGeometryDirty();
 #ifdef DEBUG_TABLE_CELLMAP
   printf("=== TableFrame::InsertFrames\n");
@@ -2446,9 +2443,8 @@ nsTableFrame::RemoveFrame(nsIAtom*        aListName,
     nsRect damageArea(0, 0, PR_MAX(1, GetColCount()), PR_MAX(1, GetRowCount()));
     SetBCDamageArea(damageArea);
   }
-  AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
-  PresContext()->PresShell()->FrameNeedsReflow(this,
-                                                  nsIPresShell::eTreeChange);
+  PresContext()->PresShell()->FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                                               NS_FRAME_HAS_DIRTY_CHILDREN);
   SetGeometryDirty();
 #ifdef DEBUG_TABLE_CELLMAP
   printf("=== TableFrame::RemoveFrame\n");
@@ -2737,8 +2733,7 @@ nsTableFrame::ReflowChildren(nsTableReflowState& aReflowState,
     // Get the frame state bits
     // See if we should only reflow the dirty child frames
     if (reflowAllKids ||
-        (kidFrame->GetStateBits() & (NS_FRAME_IS_DIRTY |
-                                     NS_FRAME_HAS_DIRTY_CHILDREN)) ||
+        NS_SUBTREE_DIRTY(kidFrame) ||
         (aReflowState.reflowState.mFlags.mSpecialHeightReflow &&
          (isPaginated || (kidFrame->GetStateBits() &
                           NS_FRAME_CONTAINS_RELATIVE_HEIGHT)))) {
diff --git a/mozilla/layout/tables/nsTableOuterFrame.cpp b/mozilla/layout/tables/nsTableOuterFrame.cpp
index 291f5d5b860..2f52a1b12d7 100644
--- a/mozilla/layout/tables/nsTableOuterFrame.cpp
+++ b/mozilla/layout/tables/nsTableOuterFrame.cpp
@@ -284,10 +284,9 @@ nsTableOuterFrame::AppendFrames(nsIAtom*        aListName,
 
     // Reflow the new caption frame. It's already marked dirty, so
     // just tell the pres shell.
-    AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eTreeChange);
-    
+      FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                       NS_FRAME_HAS_DIRTY_CHILDREN);
   }
   else {
     NS_PRECONDITION(PR_FALSE, "unexpected child list");
@@ -338,9 +337,9 @@ nsTableOuterFrame::RemoveFrame(nsIAtom*        aListName,
   mCaptionFrames.DestroyFrame(aOldFrame);
   mCaptionFrame = mCaptionFrames.FirstChild();
   
-  AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN); // also means child removed
   PresContext()->PresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+    FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                     NS_FRAME_HAS_DIRTY_CHILDREN); // also means child removed
 
   return NS_OK;
 }
@@ -1187,10 +1186,9 @@ NS_METHOD nsTableOuterFrame::Reflow(nsPresContext*           aPresContext,
     MoveOverflowToChildList(aPresContext);
   }
 
-  PRBool reflowCaption = mCaptionFrame && (reflowAllKids || (mCaptionFrame->
-    GetStateBits() & (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)));
-  PRBool reflowInner = reflowAllKids || (mInnerTableFrame->
-    GetStateBits() & (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN));
+  PRBool reflowCaption =
+    mCaptionFrame && (reflowAllKids || NS_SUBTREE_DIRTY(mCaptionFrame));
+  PRBool reflowInner = reflowAllKids || NS_SUBTREE_DIRTY(mInnerTableFrame);
 
   // First reflow the caption.  nsHTMLReflowState takes care of making
   // side captions small.
diff --git a/mozilla/layout/tables/nsTableRowFrame.cpp b/mozilla/layout/tables/nsTableRowFrame.cpp
index ef8c596150b..792f4376818 100644
--- a/mozilla/layout/tables/nsTableRowFrame.cpp
+++ b/mozilla/layout/tables/nsTableRowFrame.cpp
@@ -196,9 +196,8 @@ nsTableRowFrame::AppendFrames(nsIAtom*        aListName,
     }
   }
 
-  AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
-  PresContext()->PresShell()->FrameNeedsReflow(this,
-                                                  nsIPresShell::eTreeChange);
+  PresContext()->PresShell()->FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                                               NS_FRAME_HAS_DIRTY_CHILDREN);
   tableFrame->SetGeometryDirty();
 
   return NS_OK;
@@ -237,9 +236,8 @@ nsTableRowFrame::InsertFrames(nsIAtom*        aListName,
   // Insert the frames in the frame list
   mFrames.InsertFrames(nsnull, aPrevFrame, aFrameList);
   
-  AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
-  PresContext()->PresShell()->FrameNeedsReflow(this,
-                                                  nsIPresShell::eTreeChange);
+  PresContext()->PresShell()->FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                                               NS_FRAME_HAS_DIRTY_CHILDREN);
   tableFrame->SetGeometryDirty();
 
   return NS_OK;
@@ -263,9 +261,9 @@ nsTableRowFrame::RemoveFrame(nsIAtom*        aListName,
       // Remove the frame and destroy it
       mFrames.DestroyFrame(aOldFrame);
 
-      AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
-      PresContext()->PresShell()->FrameNeedsReflow(this,
-                                                    nsIPresShell::eTreeChange);
+      PresContext()->PresShell()->
+        FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                         NS_FRAME_HAS_DIRTY_CHILDREN);
       tableFrame->SetGeometryDirty();
     }
     else {
@@ -823,8 +821,7 @@ nsTableRowFrame::ReflowChildren(nsPresContext*          aPresContext,
     PRBool doReflowChild = PR_TRUE;
     if (!aReflowState.ShouldReflowAllKids() &&
         !aTableFrame.IsGeometryDirty() &&
-        !(kidFrame->GetStateBits() &
-          (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN))) {
+        !NS_SUBTREE_DIRTY(kidFrame)) {
       if (!aReflowState.mFlags.mSpecialHeightReflow)
         doReflowChild = PR_FALSE;
     }
@@ -875,8 +872,7 @@ nsTableRowFrame::ReflowChildren(nsPresContext*          aPresContext,
           (cellDesiredSize.width > cellFrame->GetPriorAvailWidth()) ||
           (GetStateBits() & NS_FRAME_IS_DIRTY)                      ||
           isPaginated                                               ||
-          (cellFrame->GetStateBits() &
-           (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN))       ||
+          NS_SUBTREE_DIRTY(cellFrame)                               ||
           // See if it needs a special reflow, or if it had one that we need to undo.
           (cellFrame->GetStateBits() & NS_FRAME_CONTAINS_RELATIVE_HEIGHT) ||
           HasPctHeight()) {
diff --git a/mozilla/layout/tables/nsTableRowGroupFrame.cpp b/mozilla/layout/tables/nsTableRowGroupFrame.cpp
index a1d6539fa95..d909b0e38df 100644
--- a/mozilla/layout/tables/nsTableRowGroupFrame.cpp
+++ b/mozilla/layout/tables/nsTableRowGroupFrame.cpp
@@ -384,8 +384,7 @@ nsTableRowGroupFrame::ReflowChildren(nsPresContext*        aPresContext,
 
     // Reflow the row frame
     if (reflowAllKids ||
-        (kidFrame->GetStateBits() &
-         (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) ||
+        NS_SUBTREE_DIRTY(kidFrame) ||
         (aReflowState.reflowState.mFlags.mSpecialHeightReflow &&
          (isPaginated || (kidFrame->GetStateBits() &
                           NS_FRAME_CONTAINS_RELATIVE_HEIGHT)))) {
@@ -1342,9 +1341,9 @@ nsTableRowGroupFrame::AppendFrames(nsIAtom*        aListName,
     nsTableFrame* tableFrame = nsTableFrame::GetTableFrame(this);
     if (tableFrame) {
       tableFrame->AppendRows(*this, rowIndex, rows);
-      AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
-      PresContext()->PresShell()->FrameNeedsReflow(this,
-                                                    nsIPresShell::eTreeChange);
+      PresContext()->PresShell()->
+        FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                         NS_FRAME_HAS_DIRTY_CHILDREN);
       tableFrame->SetGeometryDirty();
     }
   }
@@ -1392,9 +1391,9 @@ nsTableRowGroupFrame::InsertFrames(nsIAtom*        aListName,
     PRInt32 rowIndex = (prevRow) ? prevRow->GetRowIndex() + 1 : startRowIndex;
     tableFrame->InsertRows(*this, rows, rowIndex, PR_TRUE);
 
-    AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
-    PresContext()->PresShell()->FrameNeedsReflow(this,
-                                                    nsIPresShell::eTreeChange);
+    PresContext()->PresShell()->
+      FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                       NS_FRAME_HAS_DIRTY_CHILDREN);
     tableFrame->SetGeometryDirty();
   }
   return NS_OK;
@@ -1414,9 +1413,9 @@ nsTableRowGroupFrame::RemoveFrame(nsIAtom*        aListName,
       // remove the rows from the table (and flag a rebalance)
       tableFrame->RemoveRows((nsTableRowFrame &)*aOldFrame, 1, PR_TRUE);
 
-      AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
-      PresContext()->PresShell()->FrameNeedsReflow(this,
-                                                    nsIPresShell::eTreeChange);
+      PresContext()->PresShell()->
+        FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                         NS_FRAME_HAS_DIRTY_CHILDREN);
       tableFrame->SetGeometryDirty();
     }
   }
diff --git a/mozilla/layout/xul/base/src/grid/nsGridRow.cpp b/mozilla/layout/xul/base/src/grid/nsGridRow.cpp
index 202d331fe85..86ac6166a2a 100644
--- a/mozilla/layout/xul/base/src/grid/nsGridRow.cpp
+++ b/mozilla/layout/xul/base/src/grid/nsGridRow.cpp
@@ -92,8 +92,8 @@ nsGridRow::MarkDirty(nsBoxLayoutState& aState)
   mBottom = -1;
 
   if (mBox) {
-    mBox->AddStateBits(NS_FRAME_IS_DIRTY);
-    aState.PresShell()->FrameNeedsReflow(mBox, nsIPresShell::eTreeChange);
+    aState.PresShell()->FrameNeedsReflow(mBox, nsIPresShell::eTreeChange,
+                                         NS_FRAME_IS_DIRTY);
   }
 }
 
diff --git a/mozilla/layout/xul/base/src/grid/nsGridRowGroupLayout.cpp b/mozilla/layout/xul/base/src/grid/nsGridRowGroupLayout.cpp
index 60efe19b014..b029935b0de 100644
--- a/mozilla/layout/xul/base/src/grid/nsGridRowGroupLayout.cpp
+++ b/mozilla/layout/xul/base/src/grid/nsGridRowGroupLayout.cpp
@@ -187,10 +187,10 @@ nsGridRowGroupLayout::DirtyRows(nsIBox* aBox, nsBoxLayoutState& aState)
 {
   if (aBox) {
     // mark us dirty
-    aBox->AddStateBits(NS_FRAME_IS_DIRTY);
     // XXXldb We probably don't want to walk up the ancestor chain
     // calling MarkIntrinsicWidthsDirty for every row group.
-    aState.PresShell()->FrameNeedsReflow(aBox, nsIPresShell::eTreeChange);
+    aState.PresShell()->FrameNeedsReflow(aBox, nsIPresShell::eTreeChange,
+                                         NS_FRAME_IS_DIRTY);
     nsIBox* child = aBox->GetChildBox();
 
     while(child) {
diff --git a/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp b/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp
index 3f0a7a1e13c..11967955859 100644
--- a/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp
+++ b/mozilla/layout/xul/base/src/grid/nsGridRowLeafLayout.cpp
@@ -315,10 +315,10 @@ nsGridRowLeafLayout::DirtyRows(nsIBox* aBox, nsBoxLayoutState& aState)
 {
   if (aBox) {
     // mark us dirty
-    aBox->AddStateBits(NS_FRAME_IS_DIRTY);
     // XXXldb We probably don't want to walk up the ancestor chain
     // calling MarkIntrinsicWidthsDirty for every row.
-    aState.PresShell()->FrameNeedsReflow(aBox, nsIPresShell::eTreeChange);
+    aState.PresShell()->FrameNeedsReflow(aBox, nsIPresShell::eTreeChange,
+                                         NS_FRAME_IS_DIRTY);
   }
 }
 
diff --git a/mozilla/layout/xul/base/src/nsBoxFrame.cpp b/mozilla/layout/xul/base/src/nsBoxFrame.cpp
index 6eb07c49a1a..9454879894e 100644
--- a/mozilla/layout/xul/base/src/nsBoxFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsBoxFrame.cpp
@@ -1037,9 +1037,9 @@ nsBoxFrame::RemoveFrame(nsIAtom*        aListName,
   aOldFrame->Destroy();
 
   // mark us dirty and generate a reflow command
-  mState |= NS_FRAME_HAS_DIRTY_CHILDREN;
   PresContext()->PresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+    FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                     NS_FRAME_HAS_DIRTY_CHILDREN);
   return NS_OK;
 }
 
@@ -1066,9 +1066,9 @@ nsBoxFrame::InsertFrames(nsIAtom*        aListName,
        SetDebugOnChildList(state, mFrames.FirstChild(), PR_TRUE);
 #endif
 
-   mState |= NS_FRAME_HAS_DIRTY_CHILDREN;
    PresContext()->PresShell()->
-     FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+     FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                      NS_FRAME_HAS_DIRTY_CHILDREN);
    return NS_OK;
 }
 
@@ -1093,10 +1093,11 @@ nsBoxFrame::AppendFrames(nsIAtom*        aListName,
        SetDebugOnChildList(state, mFrames.FirstChild(), PR_TRUE);
 #endif
 
+   // XXXbz why is this NS_FRAME_FIRST_REFLOW check here?
    if (!(GetStateBits() & NS_FRAME_FIRST_REFLOW)) {
-     mState |= NS_FRAME_HAS_DIRTY_CHILDREN;
      PresContext()->PresShell()->
-       FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+       FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                        NS_FRAME_HAS_DIRTY_CHILDREN);
    }
    return NS_OK;
 }
@@ -1209,9 +1210,8 @@ nsBoxFrame::AttributeChanged(PRInt32 aNameSpaceID,
       UpdateMouseThrough();
     }
 
-    mState |= NS_FRAME_IS_DIRTY;
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eStyleChange);
+      FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
   }
   else if (aAttribute == nsGkAtoms::ordinal) {
     nsBoxLayoutState state(PresContext());
@@ -1228,10 +1228,10 @@ nsBoxFrame::AttributeChanged(PRInt32 aNameSpaceID,
     // case our ordinal doesn't matter anyway, so that's ok.
     if (parent) {
       parent->RelayoutChildAtOrdinal(state, frameToMove);
-      mState |= NS_FRAME_IS_DIRTY;
       // XXXldb Should this instead be a tree change on the child or parent?
       PresContext()->PresShell()->
-        FrameNeedsReflow(frameToMove, nsIPresShell::eStyleChange);
+        FrameNeedsReflow(parent, nsIPresShell::eStyleChange,
+                         NS_FRAME_IS_DIRTY);
     }
   }
   // If the accesskey changed, register for the new value
@@ -1408,7 +1408,7 @@ nsBoxFrame::PaintXULDebugBackground(nsIRenderingContext& aRenderingContext,
   
   // if we have dirty children or we are dirty 
   // place a green border around us.
-  if (GetStateBits & (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) {
+  if (NS_SUBTREE_DIRTY(this)) {
      nsRect dirtyr(inner);
      aRenderingContext.SetColor(NS_RGB(0,255,0));
      aRenderingContext.DrawRect(dirtyr);
@@ -2053,7 +2053,7 @@ nsBoxFrame::LayoutChildAt(nsBoxLayoutState& aState, nsIBox* aBox, const nsRect&
   nsRect oldRect(aBox->GetRect());
   aBox->SetBounds(aState, aRect);
 
-  PRBool layout = (aBox->GetStateBits() & (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) != 0;
+  PRBool layout = NS_SUBTREE_DIRTY(aBox);
   
   if (layout || (oldRect.width != aRect.width || oldRect.height != aRect.height))  {
     return aBox->Layout(aState);
diff --git a/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp b/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp
index 58c28d1fb30..b9d51d7a25c 100644
--- a/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp
@@ -172,9 +172,8 @@ nsImageBoxFrame::AttributeChanged(PRInt32 aNameSpaceID,
 
   if (aAttribute == nsGkAtoms::src) {
     UpdateImage();
-    AddStateBits(NS_FRAME_IS_DIRTY);
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eStyleChange);
+      FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
   }
   else if (aAttribute == nsGkAtoms::validate)
     UpdateLoadFlags();
@@ -508,9 +507,8 @@ NS_IMETHODIMP nsImageBoxFrame::OnStartContainer(imgIRequest *request,
                         nsPresContext::CSSPixelsToAppUnits(h));
 
   if (!(GetStateBits() & NS_FRAME_FIRST_REFLOW)) {
-    AddStateBits(NS_FRAME_IS_DIRTY);
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eStyleChange);
+      FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
   }
 
   return NS_OK;
@@ -535,9 +533,8 @@ NS_IMETHODIMP nsImageBoxFrame::OnStopDecode(imgIRequest *request,
   else {
     // Fire an onerror DOM event.
     mIntrinsicSize.SizeTo(0, 0);
-    AddStateBits(NS_FRAME_IS_DIRTY);
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eStyleChange);
+      FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
     FireImageDOMEvent(mContent, NS_LOAD_ERROR);
   }
 
diff --git a/mozilla/layout/xul/base/src/nsListBoxBodyFrame.cpp b/mozilla/layout/xul/base/src/nsListBoxBodyFrame.cpp
index 43a6ff9d640..ce8560c3cc9 100644
--- a/mozilla/layout/xul/base/src/nsListBoxBodyFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsListBoxBodyFrame.cpp
@@ -316,9 +316,8 @@ nsListBoxBodyFrame::AttributeChanged(PRInt32 aNameSpaceID,
       value.AppendInt(rowHeight*count);
       mContent->SetAttr(kNameSpaceID_None, nsGkAtoms::minheight, value, PR_FALSE);
 
-      AddStateBits(NS_FRAME_IS_DIRTY);
       PresContext()->PresShell()->
-        FrameNeedsReflow(this, nsIPresShell::eStyleChange);
+        FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
     }
   }
   else
@@ -501,9 +500,8 @@ nsListBoxBodyFrame::ReflowFinished()
   // if the row height changed then mark everything as a style change. 
   // That will dirty the entire listbox
   if (mRowHeightWasSet) {
-    AddStateBits(NS_FRAME_IS_DIRTY);
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eStyleChange);
+      FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
      PRInt32 pos = mCurrentIndex * mRowHeight;
      if (mYPosition != pos) 
        mAdjustScroll = PR_TRUE;
@@ -930,9 +928,8 @@ nsListBoxBodyFrame::InternalPositionChanged(PRBool aUp, PRInt32 aDelta)
   
   mYPosition = mCurrentIndex*mRowHeight;
   mScrolling = PR_TRUE;
-  AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
   PresContext()->PresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eResize);
+    FrameNeedsReflow(this, nsIPresShell::eResize, NS_FRAME_HAS_DIRTY_CHILDREN);
   // Flush calls CreateRows
   // XXXbz there has to be a better way to do this than flushing!
   presContext->PresShell()->FlushPendingNotifications(Flush_OnlyReflow);
@@ -1060,9 +1057,9 @@ nsListBoxBodyFrame::DestroyRows(PRInt32& aRowsToLose)
     mTopFrame = childFrame = nextFrame;
   }
 
-  AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
   PresContext()->PresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+    FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                     NS_FRAME_HAS_DIRTY_CHILDREN);
 }
 
 void
@@ -1083,9 +1080,9 @@ nsListBoxBodyFrame::ReverseDestroyRows(PRInt32& aRowsToLose)
     mBottomFrame = childFrame = prevFrame;
   }
 
-  AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
   PresContext()->PresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+    FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                     NS_FRAME_HAS_DIRTY_CHILDREN);
 }
 
 //
@@ -1242,9 +1239,9 @@ nsListBoxBodyFrame::ContinueReflow(nscoord height)
         currFrame = nextFrame;
       }
 
-      AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
       PresContext()->PresShell()->
-        FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+        FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                         NS_FRAME_HAS_DIRTY_CHILDREN);
     }
     return PR_FALSE;
   }
@@ -1260,9 +1257,9 @@ nsListBoxBodyFrame::ListBoxAppendFrames(nsIFrame* aFrameList)
   mFrames.AppendFrames(nsnull, aFrameList);
   if (mLayoutManager)
     mLayoutManager->ChildrenAppended(this, state, aFrameList);
-  AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
   PresContext()->PresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+    FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                     NS_FRAME_HAS_DIRTY_CHILDREN);
   
   return NS_OK;
 }
@@ -1275,9 +1272,9 @@ nsListBoxBodyFrame::ListBoxInsertFrames(nsIFrame* aPrevFrame, nsIFrame* aFrameLi
   mFrames.InsertFrames(nsnull, aPrevFrame, aFrameList);
   if (mLayoutManager)
     mLayoutManager->ChildrenInserted(this, state, aPrevFrame, aFrameList);
-  AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
   PresContext()->PresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+    FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                     NS_FRAME_HAS_DIRTY_CHILDREN);
 
   return NS_OK;
 }
@@ -1317,9 +1314,9 @@ nsListBoxBodyFrame::OnContentInserted(nsPresContext* aPresContext, nsIContent* a
   }
   
   CreateRows();
-  AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
   PresContext()->PresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+    FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                     NS_FRAME_HAS_DIRTY_CHILDREN);
 }
 
 // 
@@ -1390,9 +1387,9 @@ nsListBoxBodyFrame::OnContentRemoved(nsPresContext* aPresContext, nsIFrame* aChi
     RemoveChildFrame(state, aChildFrame);
   }
 
-  AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
   PresContext()->PresShell()->
-    FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+    FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                     NS_FRAME_HAS_DIRTY_CHILDREN);
 }
 
 void
diff --git a/mozilla/layout/xul/base/src/nsListBoxLayout.cpp b/mozilla/layout/xul/base/src/nsListBoxLayout.cpp
index cc8dab333c5..9e755c50fa3 100644
--- a/mozilla/layout/xul/base/src/nsListBoxLayout.cpp
+++ b/mozilla/layout/xul/base/src/nsListBoxLayout.cpp
@@ -205,7 +205,7 @@ nsListBoxLayout::LayoutInternal(nsIBox* aBox, nsBoxLayoutState& aState)
     // relayout if we must or we are dirty or some of our children are dirty
     //   or the client area is wider than us
     // XXXldb There should probably be a resize check here too!
-    if ((box->GetStateBits() & (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) || childRect.width < clientRect.width) {
+    if (NS_SUBTREE_DIRTY(box) || childRect.width < clientRect.width) {
       childRect.x = 0;
       childRect.y = yOffset;
       childRect.width = clientRect.width;
diff --git a/mozilla/layout/xul/base/src/nsMenuFrame.cpp b/mozilla/layout/xul/base/src/nsMenuFrame.cpp
index a6c18058333..274ffd91d58 100644
--- a/mozilla/layout/xul/base/src/nsMenuFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsMenuFrame.cpp
@@ -882,9 +882,9 @@ nsMenuFrame::OpenMenuInternal(PRBool aActivateFlag)
       // active dimensions.
       if (!wasOpen)
       {
-         menuPopup->AddStateBits(NS_FRAME_IS_DIRTY);
          presContext->PresShell()->
-           FrameNeedsReflow(menuPopup, nsIPresShell::eStyleChange);
+           FrameNeedsReflow(menuPopup, nsIPresShell::eStyleChange,
+                            NS_FRAME_IS_DIRTY);
          presContext->PresShell()->FlushPendingNotifications(Flush_OnlyReflow);
       }
 
@@ -903,9 +903,9 @@ nsMenuFrame::OpenMenuInternal(PRBool aActivateFlag)
       // if the height is different then reflow. It might need scrollbars force a reflow
       if (curRect.height != newHeight || mLastPref.height != newHeight)
       {
-         menuPopup->AddStateBits(NS_FRAME_IS_DIRTY);
          presContext->PresShell()->
-           FrameNeedsReflow(menuPopup, nsIPresShell::eStyleChange);
+           FrameNeedsReflow(menuPopup, nsIPresShell::eStyleChange,
+                            NS_FRAME_IS_DIRTY);
          presContext->PresShell()->FlushPendingNotifications(Flush_OnlyReflow);
       }
 
@@ -1875,9 +1875,9 @@ nsMenuFrame::RemoveFrame(nsIAtom*        aListName,
   if (mPopupFrames.ContainsFrame(aOldFrame)) {
     // Go ahead and remove this frame.
     mPopupFrames.DestroyFrame(aOldFrame);
-    AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+      FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                       NS_FRAME_HAS_DIRTY_CHILDREN);
     rv = NS_OK;
   } else {
     rv = nsBoxFrame::RemoveFrame(aListName, aOldFrame);
@@ -1902,9 +1902,9 @@ nsMenuFrame::InsertFrames(nsIAtom*        aListName,
     nsBoxLayoutState state(GetPresContext());
     SetDebug(state, aFrameList, mState & NS_STATE_CURRENTLY_IN_DEBUG);
 #endif
-    AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+      FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                       NS_FRAME_HAS_DIRTY_CHILDREN);
     rv = NS_OK;
   } else {
     rv = nsBoxFrame::InsertFrames(aListName, aPrevFrame, aFrameList);  
@@ -1931,9 +1931,9 @@ nsMenuFrame::AppendFrames(nsIAtom*        aListName,
     nsBoxLayoutState state(GetPresContext());
     SetDebug(state, aFrameList, mState & NS_STATE_CURRENTLY_IN_DEBUG);
 #endif
-    AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+      FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                       NS_FRAME_HAS_DIRTY_CHILDREN);
     rv = NS_OK;
   } else {
     rv = nsBoxFrame::AppendFrames(aListName, aFrameList); 
diff --git a/mozilla/layout/xul/base/src/nsPopupSetFrame.cpp b/mozilla/layout/xul/base/src/nsPopupSetFrame.cpp
index 4a8d7dd6199..cb4ff02092e 100644
--- a/mozilla/layout/xul/base/src/nsPopupSetFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsPopupSetFrame.cpp
@@ -580,8 +580,9 @@ nsPopupSetFrame::OpenPopup(nsPopupFrameList* aEntry, PRBool aActivateFlag)
   }
 
   if (weakFrame.IsAlive()) {
-    AddStateBits(NS_FRAME_HAS_DIRTY_CHILDREN);
-    PresContext()->PresShell()->FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+    PresContext()->PresShell()->
+      FrameNeedsReflow(this, nsIPresShell::eTreeChange,
+                       NS_FRAME_HAS_DIRTY_CHILDREN);
   }
 }
 
diff --git a/mozilla/layout/xul/base/src/nsProgressMeterFrame.cpp b/mozilla/layout/xul/base/src/nsProgressMeterFrame.cpp
index 46aba418175..f2c3e69ed20 100644
--- a/mozilla/layout/xul/base/src/nsProgressMeterFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsProgressMeterFrame.cpp
@@ -118,9 +118,8 @@ nsProgressMeterFrame::AttributeChanged(PRInt32 aNameSpaceID,
     remainderContent->SetAttr(kNameSpaceID_None, nsGkAtoms::flex, rightFlex, PR_TRUE);
 
     if (weakFrame.IsAlive()) {
-      AddStateBits(NS_FRAME_IS_DIRTY);
       PresContext()->PresShell()->
-        FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+        FrameNeedsReflow(this, nsIPresShell::eTreeChange, NS_FRAME_IS_DIRTY);
     }
   }
   return NS_OK;
diff --git a/mozilla/layout/xul/base/src/nsSliderFrame.cpp b/mozilla/layout/xul/base/src/nsSliderFrame.cpp
index 04c0fbbecb3..a1bb798f80f 100644
--- a/mozilla/layout/xul/base/src/nsSliderFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsSliderFrame.cpp
@@ -266,9 +266,8 @@ nsSliderFrame::AttributeChanged(PRInt32 aNameSpaceID,
       aAttribute == nsGkAtoms::pageincrement ||
       aAttribute == nsGkAtoms::increment) {
 
-      AddStateBits(NS_FRAME_IS_DIRTY);
       PresContext()->PresShell()->
-        FrameNeedsReflow(this, nsIPresShell::eStyleChange);
+        FrameNeedsReflow(this, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
   }
 
   return rv;
diff --git a/mozilla/layout/xul/base/src/nsSplitterFrame.cpp b/mozilla/layout/xul/base/src/nsSplitterFrame.cpp
index bf4fe6e9eda..476224489a3 100644
--- a/mozilla/layout/xul/base/src/nsSplitterFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsSplitterFrame.cpp
@@ -608,8 +608,8 @@ nsSplitterFrameInner::MouseDrag(nsPresContext* aPresContext, nsGUIEvent* aEvent)
     /*
       nsIPresShell *shell = aPresContext->PresShell();
 
-      mOuter->mState |= NS_FRAME_IS_DIRTY;
-      shell->FrameNeedsReflow(mOuter, nsIPresShell::eStyleChange);
+      shell->FrameNeedsReflow(mOuter, nsIPresShell::eStyleChange,
+                              NS_FRAME_IS_DIRTY);
     */
     mDidDrag = PR_TRUE;
   }
@@ -1002,9 +1002,8 @@ nsSplitterFrameInner::AdjustChildren(nsPresContext* aPresContext)
     aPresContext->PresShell()->FlushPendingNotifications(Flush_Display);
   }
   else {
-    mOuter->AddStateBits(NS_FRAME_IS_DIRTY);
     aPresContext->PresShell()->
-      FrameNeedsReflow(mOuter, nsIPresShell::eTreeChange);
+      FrameNeedsReflow(mOuter, nsIPresShell::eTreeChange, NS_FRAME_IS_DIRTY);
   }
 }
 
@@ -1100,8 +1099,8 @@ nsSplitterFrameInner::SetPreferredSize(nsBoxLayoutState& aState, nsIBox* aChildB
   nsWeakFrame weakBox(aChildBox);
   content->SetAttr(kNameSpaceID_None, attribute, prefValue, PR_TRUE);
   ENSURE_TRUE(weakBox.IsAlive());
-  aChildBox->AddStateBits(NS_FRAME_IS_DIRTY);
-  aState.PresShell()->FrameNeedsReflow(aChildBox, nsIPresShell::eStyleChange);
+  aState.PresShell()->FrameNeedsReflow(aChildBox, nsIPresShell::eStyleChange,
+                                       NS_FRAME_IS_DIRTY);
 }
 
 
diff --git a/mozilla/layout/xul/base/src/nsSprocketLayout.cpp b/mozilla/layout/xul/base/src/nsSprocketLayout.cpp
index e0a6fda2e48..28d1fe2ca04 100644
--- a/mozilla/layout/xul/base/src/nsSprocketLayout.cpp
+++ b/mozilla/layout/xul/base/src/nsSprocketLayout.cpp
@@ -476,7 +476,7 @@ nsSprocketLayout::Layout(nsIBox* aBox, nsBoxLayoutState& aState)
         layout = PR_FALSE;
       } else {
         // Always perform layout if we are dirty or have dirty children
-        if (!(child->GetStateBits() & (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)))
+        if (!NS_SUBTREE_DIRTY(child))
           layout = PR_FALSE;
       }
 
diff --git a/mozilla/layout/xul/base/src/nsStackLayout.cpp b/mozilla/layout/xul/base/src/nsStackLayout.cpp
index bf0a6f57c95..b404f6e4022 100644
--- a/mozilla/layout/xul/base/src/nsStackLayout.cpp
+++ b/mozilla/layout/xul/base/src/nsStackLayout.cpp
@@ -267,7 +267,7 @@ nsStackLayout::Layout(nsIBox* aBox, nsBoxLayoutState& aState)
       PRBool sizeChanged = (oldRect != childRect);
 
       // only lay out dirty children or children whose sizes have changed
-      if (sizeChanged || (child->GetStateBits() & (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN))) {
+      if (sizeChanged || NS_SUBTREE_DIRTY(child)) {
           // add in the child's margin
           nsMargin margin;
           child->GetMargin(margin);
diff --git a/mozilla/layout/xul/base/src/nsTextBoxFrame.cpp b/mozilla/layout/xul/base/src/nsTextBoxFrame.cpp
index 3d163c3c52d..a179b43819d 100644
--- a/mozilla/layout/xul/base/src/nsTextBoxFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsTextBoxFrame.cpp
@@ -123,9 +123,9 @@ nsTextBoxFrame::AttributeChanged(PRInt32         aNameSpaceID,
     UpdateAttributes(aAttribute, aResize, aRedraw);
 
     if (aResize) {
-        AddStateBits(NS_FRAME_IS_DIRTY);
         PresContext()->PresShell()->
-          FrameNeedsReflow(this, nsIPresShell::eStyleChange);
+            FrameNeedsReflow(this, nsIPresShell::eStyleChange,
+                             NS_FRAME_IS_DIRTY);
     } else if (aRedraw) {
         nsBoxLayoutState state(PresContext());
         Redraw(state);
diff --git a/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp b/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
index ba850337389..16a449849c2 100644
--- a/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
+++ b/mozilla/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
@@ -1730,8 +1730,9 @@ nsTreeBodyFrame::MarkDirtyIfSelect()
     // XXX optimize this more
 
     mStringWidth = -1;
-    AddStateBits(NS_FRAME_IS_DIRTY);
-    PresContext()->PresShell()->FrameNeedsReflow(this, nsIPresShell::eTreeChange);
+    PresContext()->PresShell()->FrameNeedsReflow(this,
+                                                 nsIPresShell::eTreeChange,
+                                                 NS_FRAME_IS_DIRTY);
   }
 }
 
@@ -2694,9 +2695,8 @@ nsTreeBodyFrame::PaintTreeBody(nsIRenderingContext& aRenderingContext,
 
   if (oldPageCount != mPageLength || mHorzWidth != CalcHorzWidth(GetScrollParts())) {
     // Schedule a ResizeReflow that will update our info properly.
-    AddStateBits(NS_FRAME_IS_DIRTY);
     PresContext()->PresShell()->
-      FrameNeedsReflow(this, nsIPresShell::eResize);
+      FrameNeedsReflow(this, nsIPresShell::eResize, NS_FRAME_IS_DIRTY);
   }
   #ifdef DEBUG
   PRInt32 rowCount = mRowCount;