diff --git a/content/base/crashtests/593302-1.html b/content/base/crashtests/593302-1.html
new file mode 100644
index 000000000000..d433de0d5810
--- /dev/null
+++ b/content/base/crashtests/593302-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <head>
+    <script type="text/javascript">
+      function boom()
+      {
+        iframe = document.getElementById("iframe");
+        iframeBody = iframe.contentDocument.body;
+        iframeBody.appendChild(makeNamedSpan("w"));
+        remove(iframe);
+        iframeBody.appendChild(makeNamedSpan("w"));
+        remove(iframeBody);
+        document.documentElement.className = "";
+      }
+
+      function makeNamedSpan(i)
+      {
+        var s = document.createElement("span");
+        s.id = i;
+        return s;
+      }
+
+      function remove(n)    { n.parentNode.removeChild(n); }
+    </script>
+  </head>
+  <body onload="boom();">
+    <iframe id="iframe" src="data:text/html,S"></iframe>
+  </body>
+</html>
diff --git a/content/base/crashtests/593302-2.html b/content/base/crashtests/593302-2.html
new file mode 100644
index 000000000000..60e77d48813f
--- /dev/null
+++ b/content/base/crashtests/593302-2.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <!-- This test should not leak. -->
+    <iframe src="data:text/html,
+      <script>
+        var elem = document.createElement('span');
+        document.mozSetImageElement('foo', elem);
+        elem.foo = document;
+      </script>"></iframe>
+  </body>
+</html>
diff --git a/content/base/crashtests/crashtests.list b/content/base/crashtests/crashtests.list
index 5255f045acd8..c0648ec780ef 100644
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -80,3 +80,5 @@ load 590395-1.html
 load 595606-1.html
 load 595606-2.html
 load 606729-1.html
+load 593302-1.html
+load 593302-2.html
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 9968117a9cc6..67ee808b5603 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -1934,6 +1934,8 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDocument)
   // manually.
 
   tmp->mInUnlinkOrDeletion = PR_FALSE;
+
+  tmp->mIdentifierMap.Clear();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 
@@ -7082,10 +7084,6 @@ nsDocument::Destroy()
   // XXX We really should let cycle collection do this, but that currently still
   //     leaks (see https://bugzilla.mozilla.org/show_bug.cgi?id=406684).
   nsContentUtils::ReleaseWrapper(static_cast<nsINode*>(this), this);
-
-  // Try really really hard to make sure we don't leak things through
-  // mIdentifierMap
-  mIdentifierMap.Clear();
 }
 
 void
