Bug 835978 - crash in nsDisplayList::HitTest r=jwatt.