Add comment to explain the bustage fix for bug 236408.

content/base/public/nsIDocument.h

@@ -121,6 +121,10 @@ public:
 
   virtual ~nsIDocument()
   {
+    // XXX The cleanup of mNodeInfoManager (calling DropDocumentReference and
+    //     releasing it) happens in the nsDocument destructor. We'd prefer to
+    //     do it here but nsNodeInfoManager is a concrete class that we don't
+    //     want to expose to users of the nsIDocument API outside of Gecko.
   }
 
   virtual nsresult StartDocumentLoad(const char* aCommand,

content/base/src/nsDocument.cpp

@@ -587,6 +587,7 @@ nsDocument::~nsDocument()
     mCSSLoader->DropDocumentReference();
   }
 
+  // XXX Ideally we'd do this cleanup in the nsIDocument destructor.
   if (mNodeInfoManager) {
     mNodeInfoManager->DropDocumentReference();
     NS_RELEASE(mNodeInfoManager);