diff --git a/mozilla/content/xul/document/src/nsXULDocument.cpp b/mozilla/content/xul/document/src/nsXULDocument.cpp
index 23b8e3eb472..d9bd0ede236 100644
--- a/mozilla/content/xul/document/src/nsXULDocument.cpp
+++ b/mozilla/content/xul/document/src/nsXULDocument.cpp
@@ -2117,6 +2117,15 @@ nsXULDocument::ContentReplaced(nsIContent* aContainer,
         nsIDocumentObserver*  observer = (nsIDocumentObserver*)mObservers[i];
         observer->ContentReplaced(this, aContainer, aOldChild, aNewChild,
                                   aIndexInContainer);
+
+        // XXXdwh hack to avoid crash, since an observer removes itself
+        // during ContentReplaced.
+        PRInt32 newCount = mObservers.Count();
+        if (newCount < count) {
+          PRInt32 diff = (count - newCount);
+          count -= diff;
+          i -= diff;
+        }
     }
     return NS_OK;
 }