diff --git a/layout/base/nsCSSRendering.cpp b/layout/base/nsCSSRendering.cpp
index d91309be173..2d8bb4616da 100644
--- a/layout/base/nsCSSRendering.cpp
+++ b/layout/base/nsCSSRendering.cpp
@@ -419,6 +419,10 @@ nsCSSRendering::PaintBorder(nsPresContext* aPresContext,
}
nsStyleBorder newStyleBorder(*styleBorder);
+ // We could do something fancy to avoid the TrackImage/UntrackImage
+ // work, but it doesn't seem worth it. (We need to call TrackImage
+ // since we're not going through nsRuleNode::ComputeBorderData.)
+ newStyleBorder.TrackImage(aPresContext);
NS_FOR_CSS_SIDES(side) {
newStyleBorder.SetBorderColor(side,
@@ -428,6 +432,11 @@ nsCSSRendering::PaintBorder(nsPresContext* aPresContext,
PaintBorderWithStyleBorder(aPresContext, aRenderingContext, aForFrame,
aDirtyRect, aBorderArea, newStyleBorder,
aStyleContext, aSkipSides);
+
+ // We could do something fancy to avoid the TrackImage/UntrackImage
+ // work, but it doesn't seem worth it. (We need to call UntrackImage
+ // since we're not going through nsStyleBorder::Destroy.)
+ newStyleBorder.UntrackImage(aPresContext);
}
void
diff --git a/layout/style/crashtests/blue-32x32.png b/layout/style/crashtests/blue-32x32.png
new file mode 100644
index 00000000000..deefd19b2ac
Binary files /dev/null and b/layout/style/crashtests/blue-32x32.png differ
diff --git a/layout/style/crashtests/border-image-visited-link.html b/layout/style/crashtests/border-image-visited-link.html
new file mode 100644
index 00000000000..b6e3ae5d783
--- /dev/null
+++ b/layout/style/crashtests/border-image-visited-link.html
@@ -0,0 +1,10 @@
+
+border-image on link with visited styles
+
+test
diff --git a/layout/style/crashtests/crashtests.list b/layout/style/crashtests/crashtests.list
index e414f287ef9..acd709c35e6 100644
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -104,3 +104,4 @@ load 945048-1.html
load 972199-1.html
load 989965-1.html
load large_border_image_width.html
+load border-image-visited-link.html