This crashes because the oldColor->mBackgroundImage it got from the oldContext is not a valid string object. This is perhap a dup of a similar bug where a style context has a bad string in a font. But I can't find that bug right now anyway. This is from a posting in the newsgroup: news://news.mozilla.org:119/3C03C2D7.firstname.lastname@example.org I'll attach a stacktrace.
I've been looking at this bug, and all I can say is that this really isn't supposed to be able to happen. I probably need to run this testcase under purify... *** This bug has been marked as a duplicate of 105619 ***
Ah, the bug I was looking for had been marked a dup of *that* bug!