Fix for bug 297311 (consistent crash when trying to call xmlDocument.replaceChild(newChild, xmlDocument.documentElement) on XML document rendered in a frame). r/sr=bz, a=asa.

content/xbl/src/nsBindingManager.cpp

@@ -415,7 +415,9 @@ nsBindingManager::ChangeDocumentFor(nsIContent* aContent, nsIDocument* aOldDocum
   if (! aOldDocument)
     return NS_ERROR_NULL_POINTER;
 
-  nsXBLBinding *binding = nsBindingManager::GetBinding(aContent);
+  // Hold a ref to the binding so it won't die when we remove it from our
+  // table.
+  nsRefPtr<nsXBLBinding> binding = nsBindingManager::GetBinding(aContent);
   if (binding) {
     binding->ChangeDocument(aOldDocument, aNewDocument);
     SetBinding(aContent, nsnull);