diff --git a/content/base/crashtests/930250.html b/content/base/crashtests/930250.html
new file mode 100644
index 00000000000..cf2c15e9e5a
--- /dev/null
+++ b/content/base/crashtests/930250.html
@@ -0,0 +1,8 @@
+
+
+
+
+
+
+
+
diff --git a/content/base/crashtests/crashtests.list b/content/base/crashtests/crashtests.list
index 14ae8345789..beaa700bdd1 100644
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -146,5 +146,6 @@ load 849601.html
skip-if(Android) load 851353-1.html
load 863950.html
load 864448.html
+load 930250.html
load 942979.html
load 978646.html
diff --git a/content/base/src/Element.cpp b/content/base/src/Element.cpp
index 95bce4bd6fa..753db285a78 100644
--- a/content/base/src/Element.cpp
+++ b/content/base/src/Element.cpp
@@ -1264,7 +1264,17 @@ public:
NS_IMETHOD Run()
{
- mManager->RemovedFromDocumentInternal(mElement, mDoc);
+ // It may be the case that the element was removed from the
+ // DOM, causing this runnable to be created, then inserted back
+ // into the document before the this runnable had a chance to
+ // tear down the binding. Only tear down the binding if the element
+ // is still no longer in the DOM. nsXBLService::LoadBinding tears
+ // down the old binding if the element is inserted back into the
+ // DOM and loads a different binding.
+ if (!mElement->IsInDoc()) {
+ mManager->RemovedFromDocumentInternal(mElement, mDoc);
+ }
+
return NS_OK;
}