--- a/layout/base/nsCSSRendering.cpp
+++ b/layout/base/nsCSSRendering.cpp
@@ -2997,16 +2997,21 @@ nsCSSRendering::PaintBackgroundWithSC(ns
 
   if (drawBackgroundImage) {
     bool clipSet = false;
     uint8_t currentBackgroundClip = NS_STYLE_IMAGELAYER_CLIP_BORDER;
     NS_FOR_VISIBLE_IMAGE_LAYERS_BACK_TO_FRONT_WITH_RANGE(i, layers, layers.mImageCount - 1,
                                                          nLayers + (layers.mImageCount -
                                                          startLayer - 1)) {
       const nsStyleImageLayers::Layer& layer = layers.mLayers[i];
+      if (layer.mImage.GetType() == eStyleImageType_Null) {
+        // Skip all processing; we don't want 'result' to be affected.
+        // XXX why does nsStyleImageLayers always allocate an empty Layer?
+        continue;
+      }
       if (!aBGClipRect) {
         if (currentBackgroundClip != layer.mClip || !clipSet) {
           currentBackgroundClip = layer.mClip;
           // If clipSet is false that means this is the bottom layer and we
           // already called GetImageLayerClip above and it stored its results
           // in clipState.
           if (clipSet) {
             autoSR.Restore(); // reset the previous one