Bug 442227, p=arenevier@fdn.fr, r=smaug,enndeakin, sr=neil

content/xul/document/crashtests/428951-1.xul

@@ -0,0 +1,21 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:mathml="http://www.w3.org/1998/Math/MathML">
+<box>
+  <box style="background: -moz-initial;" id="f">
+    <box style="margin-top: -9999999px;"/>
+  </box>
+  <mathml:divergence>
+    <box/>
+  </mathml:divergence>
+  <mathml:moment command="f"/>
+</box>
+
+<script id="script" xmlns="http://www.w3.org/1999/xhtml"><![CDATA[
+function init() {
+    var f = document.getElementsByTagName('mathml:divergence')[0];
+    window.addEventListener('DOMAttrModified',function() { f.parentNode.removeChild(f);}, true);
+    var x=document.getElementsByTagName('mathml:moment')[0];
+    x.parentNode.removeChild(x);
+}
+window.addEventListener("load", init, false);
+]]></script>
+</window>

content/xul/document/crashtests/crashtests.list

@@ -1,2 +1,3 @@
 load 326204-1.xul
 load 344215-1.xul
+load 428951-1.xul

content/xul/document/src/nsXULDocument.cpp

@@ -855,8 +855,6 @@ nsXULDocument::RemoveBroadcastListenerFor(nsIDOMElement* aBroadcaster,
                     PL_DHashTableOperate(mBroadcasterMap, aBroadcaster,
                                          PL_DHASH_REMOVE);
 
-                SynchronizeBroadcastListener(aBroadcaster, aListener, aAttr);
-
                 break;
             }
         }