Bug 883313 - Fix nsHTMLDocument::SetBody to call either ReplaceChild or AppendChild, not both. r=smaug.

content/html/document/src/nsHTMLDocument.cpp

@@ -1126,12 +1126,12 @@ nsHTMLDocument::SetBody(nsGenericHTMLElement* newBody, ErrorResult& rv)
   }
 
   // Use DOM methods so that we pass through the appropriate security checks.
-  Element* currentBody = GetBodyElement();
+  nsCOMPtr<Element> currentBody = GetBodyElement();
   if (currentBody) {
     root->ReplaceChild(*newBody, *currentBody, rv);
+  } else {
+    root->AppendChild(*newBody, rv);
   }
-
-  root->AppendChild(*newBody, rv);
 }
 
 NS_IMETHODIMP