Bug 612447 - Part 2: Protect the HTML editor from dying while a mutation event handler is in progress; r=bzbarsky a=blocking-beta8

editor/libeditor/html/nsHTMLEditor.cpp

@@ -3855,6 +3855,8 @@ nsHTMLEditor::ContentInserted(nsIDocument *aDocument, nsIContent* aContainer,
     return;
   }
 
+  nsCOMPtr<nsIHTMLEditor> kungFuDeathGrip(this);
+
   if (ShouldReplaceRootElement()) {
     ResetRootElementAndEventTarget();
   }
@@ -3874,6 +3876,8 @@ nsHTMLEditor::ContentRemoved(nsIDocument *aDocument, nsIContent* aContainer,
                              nsIContent* aChild, PRInt32 aIndexInContainer,
                              nsIContent* aPreviousSibling)
 {
+  nsCOMPtr<nsIHTMLEditor> kungFuDeathGrip(this);
+
   if (SameCOMIdentity(aChild, mRootElement)) {
     ResetRootElementAndEventTarget();
   }