Bug 360058, trying to make sure that document's propertytable doesn't have pointers to deleted nsINodes, r+sr=bz

git-svn-id: svn://10.0.0.236/trunk@215183 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/content/base/src/nsDocument.cpp

@@ -732,6 +732,11 @@ nsDocument::~nsDocument()
     NS_RELEASE(mCSSLoader);
   }
 
+  // We must delete properties before dropping document reference from
+  // NodeInfoManager, because nsNodeUtils::LastRelease can't remove properties
+  // when owner document is null.
+  mPropertyTable.DeleteAllProperties();
+
   // XXX Ideally we'd do this cleanup in the nsIDocument destructor.
   if (mNodeInfoManager) {
     mNodeInfoManager->DropDocumentReference();