Bug 742636 - Keep observed node alive during microtask if there are transient observers, r=sicking

content/base/src/nsDOMMutationObserver.h

@@ -152,7 +152,7 @@ protected:
   nsMutationReceiverBase(nsINode* aRegisterTarget,
                          nsMutationReceiverBase* aParent)
   : mTarget(nsnull), mObserver(nsnull), mParent(aParent),
-    mRegisterTarget(aRegisterTarget)
+    mRegisterTarget(aRegisterTarget), mKungFuDeathGrip(aParent->Target())
   {
     NS_ASSERTION(mParent->Subtree(), "Should clone a non-subtree observer!");
     mRegisterTarget->AddMutationObserver(this);
@@ -195,6 +195,9 @@ protected:
   // This is different than mTarget when dealing with transient observers.
   nsINode*                           mRegisterTarget;
   nsCOMArray<nsMutationReceiverBase> mTransientReceivers;
+  // While we have transient receivers, keep the original mutation receiver
+  // alive so it doesn't go away and disconnect all its transient receivers.
+  nsCOMPtr<nsINode>                  mKungFuDeathGrip;
   
 private:
   bool                               mSubtree;