--- a/accessible/src/base/nsAccessiblePivot.cpp
+++ b/accessible/src/base/nsAccessiblePivot.cpp
@@ -56,17 +56,17 @@ nsAccessiblePivot::nsAccessiblePivot(Acc
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsAccessiblePivot)
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsAccessiblePivot)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mRoot)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mPosition)
   uint32_t i, length = tmp->mObservers.Length();
   for (i = 0; i < length; ++i) {
-    cb.NoteXPCOMChild(tmp->mObservers[i]);
+    cb.NoteXPCOMChild(tmp->mObservers.ElementAt(i));
   }
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsAccessiblePivot)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mRoot)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mPosition)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mObservers)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END

--- a/xpcom/glue/nsTObserverArray.h
+++ b/xpcom/glue/nsTObserverArray.h
@@ -87,17 +87,18 @@ class nsAutoTObserverArray : protected n
     }
 
     // @return True if the array is empty or false otherwise.
     bool IsEmpty() const {
       return mArray.IsEmpty();
     }
 
     // This method provides direct access to the i'th element of the array.
-    // The given index must be within the array bounds.
+    // The given index must be within the array bounds. If the underlying array
+    // may change during iteration, use an iterator instead of this function.
     // @param i  The index of an element in the array.
     // @return   A reference to the i'th element of the array.
     elem_type& ElementAt(index_type i) {
       return mArray.ElementAt(i);
     }
 
     // Same as above, but readonly.
     const elem_type& ElementAt(index_type i) const {
@@ -113,25 +114,19 @@ class nsAutoTObserverArray : protected n
       return mArray.SafeElementAt(i, def);
     }
 
     // Same as above, but readonly.
     const elem_type& SafeElementAt(index_type i, const elem_type& def) const {
       return mArray.SafeElementAt(i, def);
     }
 
-    // Shorthand for ElementAt(i)
-    elem_type& operator[](index_type i) {
-      return ElementAt(i);
-    }
-
-    // Shorthand for ElementAt(i)
-    const elem_type& operator[](index_type i) const {
-      return ElementAt(i);
-    }
+    // No operator[] is provided because the point of this class is to support
+    // allow modifying the array during iteration, and ElementAt() is not safe
+    // in those conditions.
 
     //
     // Search methods
     //
 
     // This method searches, starting from the beginning of the array,
     // for the first element in this array that is equal to the given element.
     // 'operator==' must be defined for elem_type.
@@ -387,17 +382,17 @@ inline void
 ImplCycleCollectionTraverse(nsCycleCollectionTraversalCallback& aCallback,
                             nsTObserverArray<T>& aField,
                             const char* aName,
                             uint32_t aFlags = 0)
 {
   aFlags |= CycleCollectionEdgeNameArrayFlag;
   size_t length = aField.Length();
   for (size_t i = 0; i < length; ++i) {
-    ImplCycleCollectionTraverse(aCallback, aField[i], aName, aFlags);
+    ImplCycleCollectionTraverse(aCallback, aField.ElementAt(i), aName, aFlags);
   }
 }
 
 // XXXbz I wish I didn't have to pass in the observer type, but I
 // don't see a way to get it out of array_.
 // Note that this macro only works if the array holds pointers to XPCOM objects.
 #define NS_OBSERVER_ARRAY_NOTIFY_XPCOM_OBSERVERS(array_, obstype_, func_, params_) \
   PR_BEGIN_MACRO                                                             \