Damn! I thought we fixed all of these triggers in the core a long time ago.
To fix it, combine the is null tests with the rest of the original if condition, or you will end up with some unexepected results. Use something like the following:
if new.object_id = old.object_id and
(new.context_id = old.context_id or (new.context_id is null and old.context_id is null)) and
new.security_inherit_p = old.security_inherit_p then
return new;
end if;
