Ok, undo other attempt, apparently all it took was to move this after the function it references.

content/base/public/nsIContent.h

@@ -170,9 +170,7 @@ public:
    */
   nsIDocument *GetDocument() const
   {
-    // return GetCurrentDoc();
-    // attempt to fix 2.95.2 bustage by inlining GetCurrentDoc()'s body
-    return IsInDoc() ? GetOwnerDoc() : nsnull;
+    return GetCurrentDoc();
   }
 
   /**