Bug 304759. Forgot to check in one hunk of the patch on branch.

git-svn-id: svn://10.0.0.236/branches/MOZILLA_1_8_BRANCH@178569 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/content/base/src/nsDocument.cpp

@@ -3639,6 +3639,11 @@ nsDocument::ReplaceChild(nsIDOMNode* aNewChild, nsIDOMNode* aOldChild,
 
   mChildren.RemoveObjectAt(indx);
 
+  if (nodeType == nsIDOMNode::ELEMENT_NODE) {
+    // This must be replacing the root node. Tear down the link map
+    // because we're going to unbind all content.
+    DestroyLinkMap();
+  }
   ContentRemoved(nsnull, refContent, indx);
   refContent->UnbindFromTree();