diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 24abc92d4ce0..02b15d7b2084 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -495,11 +495,13 @@ nsIdentifierMapEntry::RemoveIdContent(nsIContent* aContent)
   nsIContent* currentContent = static_cast<nsIContent*>(mIdContentList.SafeElementAt(0));
   if (!mIdContentList.RemoveElement(aContent))
     return PR_FALSE;
-  NS_RELEASE(aContent);
   if (currentContent == aContent) {
     FireChangeCallbacks(currentContent,
                         static_cast<nsIContent*>(mIdContentList.SafeElementAt(0)));
   }
+  // Make sure the release happens after the check above, since it'll
+  // null out aContent.
+  NS_RELEASE(aContent);
   return mIdContentList.Count() == 0 && !mNameContentList && !mChangeCallbacks;
 }