fix for 72010 (contrib by alex.fritze@crocodile-clips.com). r=dr, sr=hyatt

content/base/src/nsDocument.cpp

@@ -623,7 +623,12 @@ nsDocument::~nsDocument()
   }
 
   NS_IF_RELEASE(mArena);
-  NS_IF_RELEASE(mListenerManager);
+
+  if (mListenerManager != nsnull) {
+    mListenerManager->SetListenerTarget(nsnull);
+    NS_RELEASE(mListenerManager);
+  }
+
   NS_IF_RELEASE(mDOMStyleSheets);
   NS_IF_RELEASE(mNameSpaceManager);
   if (nsnull != mHeaderData) {
@@ -2767,6 +2772,7 @@ nsresult nsDocument::GetListenerManager(nsIEventListenerManager **aInstancePtrRe
   if (NS_OK == GetNewListenerManager(aInstancePtrResult)) {
     mListenerManager = *aInstancePtrResult;
     NS_ADDREF(mListenerManager);
+    mListenerManager->SetListenerTarget(NS_STATIC_CAST(nsIDocument*,this));
     return NS_OK;
   }
   return NS_ERROR_FAILURE;

content/xul/document/src/nsXULDocument.cpp

@@ -468,6 +468,9 @@ nsXULDocument::~nsXULDocument()
     delete mTemplateBuilderTable;
     delete mBoxObjectTable;
 
+    if (mListenerManager)
+        mListenerManager->SetListenerTarget(nsnull);
+
     if (--gRefCnt == 0) {
         if (gRDFService) {
             nsServiceManager::ReleaseService(kRDFServiceCID, gRDFService);
@@ -4174,6 +4177,8 @@ nsXULDocument::GetListenerManager(nsIEventListenerManager** aResult)
                                                 getter_AddRefs(mListenerManager));
 
         if (NS_FAILED(rv)) return rv;
+
+        mListenerManager->SetListenerTarget(NS_STATIC_CAST(nsIDocument*,this));
     }
     *aResult = mListenerManager;
     NS_ADDREF(*aResult);