diff --git a/mozilla/content/html/document/src/nsHTMLContentSink.cpp b/mozilla/content/html/document/src/nsHTMLContentSink.cpp index 65d0aa7984c..bfa0b21f48e 100644 --- a/mozilla/content/html/document/src/nsHTMLContentSink.cpp +++ b/mozilla/content/html/document/src/nsHTMLContentSink.cpp @@ -5601,7 +5601,11 @@ HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode& aNode) if (mCurrentContext->mStackPos <= 0) { return NS_ERROR_FAILURE; } - nsIHTMLContent* parent = + + // Inserting the element into the document may execute a script. + // This can potentially make the parent go away. So, hold + // on to it till we are done. + nsCOMPtr parent = mCurrentContext->mStack[mCurrentContext->mStackPos - 1].mContent; nsCOMPtr element; nsCOMPtr nodeInfo;