Regression, Firefox 3.6.28 drop-down-menu, blue selection-rectangle stops drawing when hovering specific items

VBox 4.3.12, VBEMP, inbuilt Mesa, 800x600 desktop resolution 32bpp

Reproduction steps

• install Firefox 3.6.28 from rapps and start up its main app
• open the drop-down-menu and slowly hover the items within

Expected result

• The item under the mouse pointer should be drawn in white and at the same time should be selected by a blue-selection-rectangle, like
  2k3sp2_ok.webm
• The seperator lines should not draw the blue rectangle
• Disabled menu items should draw the blue rectangle

Observed result

• The item under the mouse pointer is drawn white, but the blue selection rectangle is not always drawn
• My feeling is, that we initially draw the blue selection rectangle properly, but as soon as the mouse-pointer hovers a disabled entry in the menu, or a seperator-line, then the blue rectangle breaks (at least it looks to me like that)
  0.4.13-RC-40-g63f46f3_broken.webm
  0.4.13-RC-40-g63f46f3_broken.log (ros logs nothing)

It is a regression, because 0.4.13-dev-2-g88f899e_was_still_perfect.webm

Regression test
ReactOS-0.4.13-RC-40-g63f46f3.iso affected
reactos-bootcd-0.4.13-dev-650-g34bf247-x86-gcc-lin-dbg.iso affected
reactos-bootcd-0.4.13-dev-369-g7eead93-x86-gcc-lin-dbg.iso affected
reactos-bootcd-0.4.13-dev-240-gc4e2826-x86-gcc-lin-dbg.iso affected
reactos-bootcd-0.4.13-dev-209-gdc7f4f6-x86-gcc-lin-dbg.iso affected and guilty
reactos-bootcd-0.4.13-dev-208-g94b4b5c-x86-gcc-lin-dbg.iso ok
reactos-bootcd-0.4.13-dev-160-gebd39aa-x86-gcc-lin-dbg.iso ok
reactos-bootcd-0.4.13-dev-2-g88f899e-x86-gcc-lin-dbg.iso ok