--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -3563,28 +3563,28 @@ nsINode::doInsertChildAt(nsIContent* aKi
       nsCOMPtr<nsIDOMNode> adoptedKid;
       rv = domDoc->AdoptNode(kid, getter_AddRefs(adoptedKid));
       NS_ENSURE_SUCCESS(rv, rv);
 
       NS_ASSERTION(adoptedKid == kid, "Uh, adopt node changed nodes?");
     }
   }
 
-  PRUint32 childCount = aChildArray.ChildCount();
-  NS_ENSURE_TRUE(aIndex <= childCount, NS_ERROR_ILLEGAL_VALUE);
-
   // The id-handling code, and in the future possibly other code, need to
   // react to unexpected attribute changes.
   nsMutationGuard::DidMutate();
 
-  PRBool isAppend = (aIndex == childCount);
-
+  // Do this before checking the child-count since this could cause mutations
   nsIDocument* doc = GetCurrentDoc();
   mozAutoDocUpdate updateBatch(doc, UPDATE_CONTENT_MODEL, aNotify);
 
+  PRUint32 childCount = aChildArray.ChildCount();
+  NS_ENSURE_TRUE(aIndex <= childCount, NS_ERROR_ILLEGAL_VALUE);
+  PRBool isAppend = (aIndex == childCount);
+
   rv = aChildArray.InsertChildAt(aKid, aIndex);
   NS_ENSURE_SUCCESS(rv, rv);
   if (aIndex == 0) {
     mFirstChild = aKid;
   }
 
   nsIContent* parent =
     IsNodeOfType(eDOCUMENT) ? nsnull : static_cast<nsIContent*>(this);
@@ -4014,16 +4014,18 @@ nsINode::ReplaceOrInsertBefore(PRBool aR
   if (IsNodeOfType(eATTRIBUTE)) {
     return NS_ERROR_NOT_IMPLEMENTED;
   }
 
   nsIContent* refContent;
   nsresult res = NS_OK;
   PRInt32 insPos;
 
+  mozAutoDocConditionalContentUpdateBatch batch(GetCurrentDoc(), PR_TRUE);
+
   // Figure out which index to insert at
   if (aRefChild) {
     insPos = IndexOf(aRefChild);
     if (insPos < 0) {
       return NS_ERROR_DOM_NOT_FOUND_ERR;
     }
 
     if (aRefChild == aNewChild) {
@@ -4075,21 +4077,16 @@ nsINode::ReplaceOrInsertBefore(PRBool aR
       NS_ENSURE_SUCCESS(rv, rv);
 
       NS_ASSERTION(adoptedKid == newChild, "Uh, adopt node changed nodes?");
       NS_ASSERTION(HasSameOwnerDoc(newContent) && doc == GetOwnerDoc(),
                    "ownerDocument changed again after adopting!");
     }
   }
 
-  // We want an update batch when we expect several mutations to be performed,
-  // which is when we're replacing a node, or when we're inserting a fragment.
-  mozAutoDocConditionalContentUpdateBatch batch(GetCurrentDoc(),
-    aReplace || nodeType == nsIDOMNode::DOCUMENT_FRAGMENT_NODE);
-
   // If we're replacing
   if (aReplace) {
     refContent = GetChildAt(insPos + 1);
 
     nsMutationGuard guard;
 
     res = RemoveChildAt(insPos, PR_TRUE);
     NS_ENSURE_SUCCESS(res, res);