fix for blocker bug #106646. hyatt's hack applied to the ContentReplaced() case.

sr=hyatt.


git-svn-id: svn://10.0.0.236/trunk@106282 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/content/xul/document/src/nsXULDocument.cpp

@@ -2117,6 +2117,15 @@ nsXULDocument::ContentReplaced(nsIContent* aContainer,
         nsIDocumentObserver*  observer = (nsIDocumentObserver*)mObservers[i];
         observer->ContentReplaced(this, aContainer, aOldChild, aNewChild,
                                   aIndexInContainer);
+
+        // XXXdwh hack to avoid crash, since an observer removes itself
+        // during ContentReplaced.
+        PRInt32 newCount = mObservers.Count();
+        if (newCount < count) {
+          PRInt32 diff = (count - newCount);
+          count -= diff;
+          i -= diff;
+        }
     }
     return NS_OK;
 }