Referencing the user stylesheet from JavaScript can lead to a browser crash. To reproduce the crash: 1) Download the attached stylesheet. 2) In Safari Preferences > Advanced > Style Sheet, choose the stylesheet you downloaded in step 1). 3) Open the attached reduction. Patch forthcoming.
Created attachment 14104 [details] User stylesheet for reproducing
Created attachment 14105 [details] HTML for reproducing (will crash when the user stylesheet is set)
Created attachment 14106 [details] Change m_userSheet into a RefPtr
Comment on attachment 14106 [details] Change m_userSheet into a RefPtr r=me
Landed in r20992.