diff --git a/mozilla/content/shared/public/nsLayoutAtomList.h b/mozilla/content/shared/public/nsLayoutAtomList.h
index 20fb24c417e..b98843f3c17 100644
--- a/mozilla/content/shared/public/nsLayoutAtomList.h
+++ b/mozilla/content/shared/public/nsLayoutAtomList.h
@@ -101,6 +101,7 @@ LAYOUT_ATOM(bulletFrame, "BulletFrame")
 LAYOUT_ATOM(fieldSetFrame, "FieldSetFrame")
 LAYOUT_ATOM(gfxButtonControlFrame, "gfxButtonControlFrame")
 LAYOUT_ATOM(subDocumentFrame, "subDocumentFrame")
+LAYOUT_ATOM(imageBoxFrame, "ImageBoxFrame")
 LAYOUT_ATOM(imageFrame, "ImageFrame")
 LAYOUT_ATOM(imageControlFrame, "ImageControlFrame")
 LAYOUT_ATOM(inlineFrame, "InlineFrame")
diff --git a/mozilla/layout/html/base/src/nsPresShell.cpp b/mozilla/layout/html/base/src/nsPresShell.cpp
index a62e4aa1f32..ad032ac3348 100644
--- a/mozilla/layout/html/base/src/nsPresShell.cpp
+++ b/mozilla/layout/html/base/src/nsPresShell.cpp
@@ -6556,6 +6556,18 @@ ReResolveMenusAndTrees(nsIFrame *aFrame, void *aClosure)
   return PR_TRUE;
 }
 
+PR_STATIC_CALLBACK(PRBool)
+ReframeImageBoxes(nsIFrame *aFrame, void *aClosure)
+{
+  nsStyleChangeList *list = NS_STATIC_CAST(nsStyleChangeList*, aClosure);
+  if (aFrame->GetType() == nsLayoutAtoms::imageBoxFrame) {
+    list->AppendChange(aFrame, aFrame->GetContent(),
+                       NS_STYLE_HINT_FRAMECHANGE);
+    return PR_FALSE; // don't walk descendants
+  }
+  return PR_TRUE; // walk descendants
+}
+
 static void
 WalkFramesThroughPlaceholders(nsIPresContext *aPresContext, nsIFrame *aFrame,
                               frameWalkerFn aFunc, void *aClosure)
@@ -6602,9 +6614,17 @@ PresShell::Observe(nsISupports* aSubject,
     GetRootFrame(&rootFrame);
     // Need to null-check because "chrome-flush-skin-caches" can happen
     // at interesting times during startup.
-    if (rootFrame)
+    if (rootFrame) {
       WalkFramesThroughPlaceholders(mPresContext, rootFrame,
                                     &ReResolveMenusAndTrees, nsnull);
+
+      // Because "chrome:" URL equality is messy, reframe image box
+      // frames (hack!).
+      nsStyleChangeList changeList;
+      WalkFramesThroughPlaceholders(mPresContext, rootFrame,
+                                    ReframeImageBoxes, &changeList);
+      mFrameConstructor->ProcessRestyledFrames(changeList, mPresContext);
+    }
     return NS_OK;
   }
 #endif
diff --git a/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp b/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp
index 7385109d7b5..d4f38eaa3b2 100644
--- a/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsImageBoxFrame.cpp
@@ -63,6 +63,7 @@
 #include "nsIImage.h"
 #include "nsIWidget.h"
 #include "nsHTMLAtoms.h"
+#include "nsLayoutAtoms.h"
 #include "nsIDocument.h"
 #include "nsIHTMLDocument.h"
 #include "nsStyleConsts.h"
@@ -535,7 +536,7 @@ nsImageBoxFrame::DidSetStyleContext( nsIPresContext* aPresContext )
 {
   // Fetch our subrect.
   const nsStyleList* myList = GetStyleList();
-  mSubRect = myList->mImageRegion;
+  mSubRect = myList->mImageRegion; // before |mSuppressStyleCheck| test!
 
   if (mUseSrcAttr || mSuppressStyleCheck)
     return NS_OK; // No more work required, since the image isn't specified by style.
@@ -644,6 +645,12 @@ nsImageBoxFrame::GetAscent(nsBoxLayoutState& aState, nscoord& aCoord)
   return NS_OK;
 }
 
+nsIAtom*
+nsImageBoxFrame::GetType() const
+{
+  return nsLayoutAtoms::imageBoxFrame;
+}
+
 #ifdef DEBUG
 NS_IMETHODIMP
 nsImageBoxFrame::GetFrameName(nsAString& aResult) const
diff --git a/mozilla/layout/xul/base/src/nsImageBoxFrame.h b/mozilla/layout/xul/base/src/nsImageBoxFrame.h
index 34a6c495be1..d01e652ebd3 100644
--- a/mozilla/layout/xul/base/src/nsImageBoxFrame.h
+++ b/mozilla/layout/xul/base/src/nsImageBoxFrame.h
@@ -92,6 +92,7 @@ public:
 
   NS_IMETHOD Destroy(nsIPresContext* aPresContext);
 
+  virtual nsIAtom* GetType() const;
 #ifdef DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const;
 #endif