diff --git a/mozilla/docshell/base/nsWebShell.cpp b/mozilla/docshell/base/nsWebShell.cpp
index 01ab710d4d7..8fdf793cb34 100644
--- a/mozilla/docshell/base/nsWebShell.cpp
+++ b/mozilla/docshell/base/nsWebShell.cpp
@@ -554,11 +554,11 @@ nsWebShell::~nsWebShell()
   // Cancel any timers that were set for this loader.
   CancelRefreshURLTimers();
 
+  ++mRefCnt; // following releases can cause this destructor to be called
+             // recursively if the refcount is allowed to remain 0
+
   NS_IF_RELEASE(mWindow);
   NS_IF_RELEASE(mThreadEventQueue);
-
-  ++mRefCnt; // hack will come back to this (pinkerton, scc)
-  
   NS_IF_RELEASE(mContentViewer);
   NS_IF_RELEASE(mDeviceContext);
   NS_IF_RELEASE(mPrefs);
diff --git a/mozilla/webshell/src/nsWebShell.cpp b/mozilla/webshell/src/nsWebShell.cpp
index 01ab710d4d7..8fdf793cb34 100644
--- a/mozilla/webshell/src/nsWebShell.cpp
+++ b/mozilla/webshell/src/nsWebShell.cpp
@@ -554,11 +554,11 @@ nsWebShell::~nsWebShell()
   // Cancel any timers that were set for this loader.
   CancelRefreshURLTimers();
 
+  ++mRefCnt; // following releases can cause this destructor to be called
+             // recursively if the refcount is allowed to remain 0
+
   NS_IF_RELEASE(mWindow);
   NS_IF_RELEASE(mThreadEventQueue);
-
-  ++mRefCnt; // hack will come back to this (pinkerton, scc)
-  
   NS_IF_RELEASE(mContentViewer);
   NS_IF_RELEASE(mDeviceContext);
   NS_IF_RELEASE(mPrefs);