We can destroy style contexts during ruletree reconstruct. Bug 403454,

r+sr=dbaron

layout/style/nsStyleSet.cpp

@@ -858,14 +858,16 @@ nsStyleSet::NotifyStyleContextDestroyed(nsPresContext* aPresContext,
     return;
 
   NS_ASSERTION(mRuleWalker->AtRoot(), "Rule walker should be at root");
-  
-  if (mOldRuleTree)
-    return;
 
+  // Remove style contexts from mRoots even if mOldRuleTree is non-null.  This
+  // could be a style context from the new ruletree!
   if (!aStyleContext->GetParent()) {
     mRoots.RemoveElement(aStyleContext);
   }
 
+  if (mOldRuleTree)
+    return;
+
   if (++mDestroyedCount == kGCInterval) {
     mDestroyedCount = 0;