Bug 522030 followup; do the release at a better point. Fixes orange.

content/base/src/nsDocument.cpp

@@ -495,11 +495,13 @@ nsIdentifierMapEntry::RemoveIdContent(nsIContent* aContent)
   nsIContent* currentContent = static_cast<nsIContent*>(mIdContentList.SafeElementAt(0));
   if (!mIdContentList.RemoveElement(aContent))
     return PR_FALSE;
-  NS_RELEASE(aContent);
   if (currentContent == aContent) {
     FireChangeCallbacks(currentContent,
                         static_cast<nsIContent*>(mIdContentList.SafeElementAt(0)));
   }
+  // Make sure the release happens after the check above, since it'll
+  // null out aContent.
+  NS_RELEASE(aContent);
   return mIdContentList.Count() == 0 && !mNameContentList && !mChangeCallbacks;
 }