From f6ad7172e0548912e280988807a43a1cefcf2e56 Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Wed, 4 Apr 2012 18:11:57 +0300
Subject: [PATCH] Bug 742237, MutationObserver crashes during GC, r=sicking

---
 content/base/src/nsDOMMutationObserver.h | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/content/base/src/nsDOMMutationObserver.h b/content/base/src/nsDOMMutationObserver.h
index 57fa691c3f45..97eefe66a29f 100644
--- a/content/base/src/nsDOMMutationObserver.h
+++ b/content/base/src/nsDOMMutationObserver.h
@@ -261,14 +261,18 @@ public:
       mRegisterTarget->RemoveMutationObserver(this);
       mRegisterTarget = nsnull;
     }
-    if (mTarget && mObserver) {
-      mTarget->UnbindObject(mObserver);
-    }
 
     mParent = nsnull;
+    nsINode* target = mTarget;
     mTarget = nsnull;
+    nsIDOMMozMutationObserver* observer = mObserver;
     mObserver = nsnull;
     RemoveClones();
+
+    if (target && observer) {
+      // Unbind may delete 'this'!
+      target->UnbindObject(observer);
+    }
   }
 
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_IMUTATION_OBSERVER_IID)