From fe5a90ed8e56f487b794ca0277dddb609ad3378d Mon Sep 17 00:00:00 2001
From: "sspitzer%netscape.com"
 <sspitzer%netscape.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Thu, 25 Oct 2001 20:39:40 +0000
Subject: [PATCH] fix for blocker bug #106646.  hyatt's hack applied to the
 ContentReplaced() case. sr=hyatt.

git-svn-id: svn://10.0.0.236/trunk@106282 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/content/xul/document/src/nsXULDocument.cpp | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/mozilla/content/xul/document/src/nsXULDocument.cpp b/mozilla/content/xul/document/src/nsXULDocument.cpp
index 23b8e3eb472..d9bd0ede236 100644
--- a/mozilla/content/xul/document/src/nsXULDocument.cpp
+++ b/mozilla/content/xul/document/src/nsXULDocument.cpp
@@ -2117,6 +2117,15 @@ nsXULDocument::ContentReplaced(nsIContent* aContainer,
         nsIDocumentObserver*  observer = (nsIDocumentObserver*)mObservers[i];
         observer->ContentReplaced(this, aContainer, aOldChild, aNewChild,
                                   aIndexInContainer);
+
+        // XXXdwh hack to avoid crash, since an observer removes itself
+        // during ContentReplaced.
+        PRInt32 newCount = mObservers.Count();
+        if (newCount < count) {
+          PRInt32 diff = (count - newCount);
+          count -= diff;
+          i -= diff;
+        }
     }
     return NS_OK;
 }