Take a look at the following chunk of code, where doc is an HTML document:

  // get the root content
  nsCOMPtr<nsIDOMNSHTMLElement> nsElement = do_QueryInterface(doc->GetRootContent());
  if (!nsElement) {return NS_ERROR_NULL_POINTER; }

  // let's get the size of the document
  PRInt32 w, h;
  nsElement->GetOffsetWidth(&w);
  nsElement->GetOffsetHeight(&h);

In 1.7.1, w and h are >= than the size of the viewport. In the trunk, they are not max'ed any longer with the viewport's size. That is probably the cause of this crasher and that's also why you don't see the tooltip when you resize a positioned object using the resizers at the bottom of the element. Can someone tell me why it changed ?

Update: this is now bug 260498