Hold the ref to the binding as we install its fields. Bug 404869, r+sr=sicking

dom/src/base/nsDOMClassInfo.cpp

@@ -7059,7 +7059,7 @@ nsElementSH::Enumerate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
     return NS_OK;
   }
 
-  nsXBLBinding* binding = doc->BindingManager()->GetBinding(content);
+  nsRefPtr<nsXBLBinding> binding = doc->BindingManager()->GetBinding(content);
   if (!binding) {
     // Nothing else to do here
     return NS_OK;