Make ReplaceObjectAt a little safer. Bug 227780, r=timeless, sr=alecf

xpcom/ds/nsCOMArray.cpp

@@ -115,8 +115,9 @@ nsCOMArray_base::ReplaceObjectAt(nsISupports* aObject, PRInt32 aIndex)
     // ReplaceElementAt could fail, such as if the array grows
     // so only release the existing object if the replacement succeeded
     if (result) {
-        NS_IF_RELEASE(oldObject);
+        // Make sure to addref first, in case aObject == oldObject
         NS_IF_ADDREF(aObject);
+        NS_IF_RELEASE(oldObject);
     }
     return result;
 }