Fix orange by properly refcounting

content/base/public/nsINode.h

@@ -56,6 +56,8 @@ class nsIPrincipal;
 class nsVoidArray;
 class nsIMutationObserver;
 class nsChildContentList;
+class nsNodeWeakReference;
+class nsNodeSupportsWeakRefTearoff;
 
 // This bit will be set if the node doesn't have nsSlots
 #define NODE_DOESNT_HAVE_SLOTS       0x00000001U

content/base/src/nsDOMAttribute.cpp

@@ -266,6 +266,7 @@ nsDOMAttribute::GetChildNodes(nsIDOMNodeList** aChildNodes)
   if (!slots->mChildNodes) {
     slots->mChildNodes = new nsChildContentList(this);
     NS_ENSURE_TRUE(slots->mChildNodes, NS_ERROR_OUT_OF_MEMORY);
+    NS_ADDREF(slots->mChildNodes);
   }
 
   NS_ADDREF(*aChildNodes = slots->mChildNodes);

content/base/src/nsDocument.cpp

@@ -3403,6 +3403,7 @@ nsDocument::GetChildNodes(nsIDOMNodeList** aChildNodes)
   if (!slots->mChildNodes) {
     slots->mChildNodes = new nsChildContentList(this);
     NS_ENSURE_TRUE(slots->mChildNodes, NS_ERROR_OUT_OF_MEMORY);
+    NS_ADDREF(slots->mChildNodes);
   }
 
   NS_ADDREF(*aChildNodes = slots->mChildNodes);

content/base/src/nsGenericDOMDataNode.cpp

@@ -164,6 +164,7 @@ nsGenericDOMDataNode::GetChildNodes(nsIDOMNodeList** aChildNodes)
   if (!slots->mChildNodes) {
     slots->mChildNodes = new nsChildContentList(this);
     NS_ENSURE_TRUE(slots->mChildNodes, NS_ERROR_OUT_OF_MEMORY);
+    NS_ADDREF(slots->mChildNodes);
   }
 
   NS_ADDREF(*aChildNodes = slots->mChildNodes);

content/base/src/nsGenericElement.cpp

@@ -1296,6 +1296,7 @@ nsGenericElement::GetChildNodes(nsIDOMNodeList** aChildNodes)
     if (!slots->mChildNodes) {
       return NS_ERROR_OUT_OF_MEMORY;
     }
+    NS_ADDREF(slots->mChildNodes);
   }
 
   NS_ADDREF(*aChildNodes = slots->mChildNodes);