Bug 578696 part 6. Stop holding strong refs when calling CharacterDataChanged. r=sicking

content/base/public/nsIMutationObserver.h

@@ -139,6 +139,12 @@ public:
    * @param aDocument The owner-document of aContent. Can be null.
    * @param aContent  The piece of content that changed. Is never null.
    * @param aInfo     The structure with information details about the change.
+   *
+   * @note Callers of this method might not hold a strong reference to the
+   *       observer.  The observer is responsible for making sure it stays
+   *       alive for the duration of the call as needed.  The observer may
+   *       assume that this call will happen when there are script blockers on
+   *       the stack.
    */
   virtual void CharacterDataChanged(nsIDocument *aDocument,
                                     nsIContent* aContent,

content/base/src/nsNodeUtils.cpp

@@ -123,7 +123,7 @@ nsNodeUtils::CharacterDataChanged(nsIContent* aContent,
                                   CharacterDataChangeInfo* aInfo)
 {
   nsIDocument* doc = aContent->GetOwnerDoc();
-  IMPL_STRONGREF_MUTATION_NOTIFICATION(CharacterDataChanged, aContent,
+  IMPL_MUTATION_NOTIFICATION(CharacterDataChanged, aContent,
                              (doc, aContent, aInfo));
 }
 

content/html/content/src/nsHTMLTextAreaElement.cpp

@@ -986,6 +986,9 @@ nsHTMLTextAreaElement::ContentChanged(nsIContent* aContent)
 {
   if (!mValueChanged && mDoneAddingChildren &&
       nsContentUtils::IsInSameAnonymousTree(this, aContent)) {
+    // Hard to say what the reset can trigger, so be safe pending
+    // further auditing.
+    nsCOMPtr<nsIMutationObserver> kungFuDeathGrip(this);
     Reset();
   }
 }

content/xslt/src/xpath/nsXPathResult.cpp

@@ -381,11 +381,12 @@ nsXPathResult::Invalidate(const nsIContent* aChangeRoot)
         }
     }
 
+    mInvalidIteratorState = PR_TRUE;
+    // Make sure nulling out mDocument is the last thing we do.
     if (mDocument) {
         mDocument->RemoveMutationObserver(this);
         mDocument = nsnull;
     }
-    mInvalidIteratorState = PR_TRUE;
 }
 
 nsresult