Bug 578696 part 3. Stop holding strong refs when calling ParentChainChanged. r=sicking

content/base/public/nsIMutationObserver.h

@@ -254,6 +254,10 @@ public:
    * parent chain changed.
    *
    * @param aContent  The piece of content that had its parent changed.
+   *
+   * @note Callers of this method might not hold a strong reference to
+   *       the observer.  The observer is responsible for making sure it
+   *       stays alive for the duration of the call as needed.
    */
 
   virtual void ParentChainChanged(nsIContent *aContent) = 0;

content/base/src/nsNodeUtils.cpp

@@ -220,7 +220,7 @@ nsNodeUtils::ParentChainChanged(nsIContent *aContent)
 
   nsINode::nsSlots* slots = aContent->GetExistingSlots();
   if (slots && !slots->mMutationObservers.IsEmpty()) {
-    NS_OBSERVER_ARRAY_NOTIFY_XPCOM_OBSERVERS(
+    NS_OBSERVER_ARRAY_NOTIFY_OBSERVERS(
         slots->mMutationObservers,
         nsIMutationObserver,
         ParentChainChanged,

content/base/src/nsRange.cpp

@@ -353,6 +353,8 @@ nsRange::ParentChainChanged(nsIContent *aContent)
   NS_ASSERTION(newRoot, "No valid boundary or root found!");
   NS_ASSERTION(newRoot == IsValidBoundary(mEndParent),
                "Start parent and end parent give different root!");
+  // This is safe without holding a strong ref to self as long as the change
+  // of mRoot is the last thing in DoSetRange.
   DoSetRange(mStartParent, mStartOffset, mEndParent, mEndOffset, newRoot);
 }
 
@@ -473,6 +475,8 @@ nsRange::DoSetRange(nsINode* aStartN, PRInt32 aStartOffset,
   mEndParent = aEndN;
   mEndOffset = aEndOffset;
   mIsPositioned = !!mStartParent;
+  // This needs to be the last thing this function does.  See comment
+  // in ParentChainChanged.
   mRoot = aRoot;
 }