Created attachment 263695 [details] testcase Loading this testcase in a Mac debug build crashes [@ nsStyleContext::GetParent]. It's within nsFrameManager::DebugVerifyStyleTree so I'm guessing it's debug-only.
Probably fixed by the patch in bug 379386 -- at least my tree with that patch (and all sorts of others, of course), doesn't crash, while another of my trees does, with assertions consistent with that bug.
Yep. It crashed in a build from a few hours ago, and now it doesn't. (In the old build, it also triggered the assertion in the other bug's summary.)
Crashtest checked in.