When you change a list that has list-style: none to also be display: none, there is a crash due to a missing nil check.
Created attachment 6004 [details] A test case demonstrating the crash
This is a regression, it does not happen in Safari 2.0.2.
Created attachment 6005 [details] the fix (including test case)
A reproducible crasher regression should be P1.
Comment on attachment 6005 [details] the fix (including test case) r=me
Looks like Dave Harrison fixed this (in the exact same way, line for line) but I'll add the layout test anyway.
Removing Regression keyword from bugs already fixed.