diff --git a/mozilla/docshell/shistory/public/nsISHEntry.idl b/mozilla/docshell/shistory/public/nsISHEntry.idl
index 39c88dfa5ac..dcc4efb6344 100644
--- a/mozilla/docshell/shistory/public/nsISHEntry.idl
+++ b/mozilla/docshell/shistory/public/nsISHEntry.idl
@@ -82,9 +82,7 @@ interface nsISHEntry : nsIHistoryEntry
     [noscript] void setViewerBounds([const] in nsRect bounds);
 
     /**
-     * Saved child docshells corresponding to contentViewer.  There are weak
-     * references since it's assumed that the content viewer's document has
-     * an owning reference to the subdocument for each shell.  The child shells
+     * Saved child docshells corresponding to contentViewer.  The child shells
      * are restored as children of the parent docshell, in this order, when the
      * parent docshell restores a saved presentation.
      */
diff --git a/mozilla/docshell/shistory/src/nsSHEntry.cpp b/mozilla/docshell/shistory/src/nsSHEntry.cpp
index b4f33592ddc..947bcfd8f90 100644
--- a/mozilla/docshell/shistory/src/nsSHEntry.cpp
+++ b/mozilla/docshell/shistory/src/nsSHEntry.cpp
@@ -572,16 +572,14 @@ NS_IMETHODIMP
 nsSHEntry::AddChildShell(nsIDocShellTreeItem *aShell)
 {
   NS_ASSERTION(aShell, "Null child shell added to history entry");
-  mChildShells.AppendElement(aShell);
+  mChildShells.AppendObject(aShell);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsSHEntry::ChildShellAt(PRInt32 aIndex, nsIDocShellTreeItem **aShell)
 {
-  NS_IF_ADDREF(*aShell =
-               NS_STATIC_CAST(nsIDocShellTreeItem*,
-                              mChildShells.SafeElementAt(aIndex)));
+  NS_IF_ADDREF(*aShell = mChildShells.SafeObjectAt(aIndex));
   return NS_OK;
 }
 
diff --git a/mozilla/docshell/shistory/src/nsSHEntry.h b/mozilla/docshell/shistory/src/nsSHEntry.h
index 0a3a0b6c959..ba16e97a7bc 100644
--- a/mozilla/docshell/shistory/src/nsSHEntry.h
+++ b/mozilla/docshell/shistory/src/nsSHEntry.h
@@ -102,7 +102,7 @@ private:
   nsISHEntry *                    mParent;  // weak reference
   nsCOMPtr<nsISupports>           mWindowState;
   nsRect                          mViewerBounds;
-  nsVoidArray                     mChildShells;
+  nsCOMArray<nsIDocShellTreeItem> mChildShells;
   nsCOMPtr<nsISupportsArray>      mRefreshURIList;
   nsCOMPtr<nsISupports>           mOwner;
 };
diff --git a/mozilla/layout/base/nsDocumentViewer.cpp b/mozilla/layout/base/nsDocumentViewer.cpp
index a4f17d0ab92..39a053f2510 100644
--- a/mozilla/layout/base/nsDocumentViewer.cpp
+++ b/mozilla/layout/base/nsDocumentViewer.cpp
@@ -1476,6 +1476,19 @@ DocumentViewerImpl::Destroy()
     if (mPrintEngine->CheckBeforeDestroy()) {
       return NS_OK;
     }
+
+    // Clear the list of old child docshells. CChild docshells for the new
+    // document will be constructed as frames are created.
+    nsCOMPtr<nsIDocShellTreeNode> node = do_QueryInterface(container);
+    if (node) {
+      PRInt32 count;
+      node->GetChildCount(&count);
+      for (PRInt32 i = 0; i < count; ++i) {
+        nsCOMPtr<nsIDocShellTreeItem> child;
+        node->GetChildAt(0, getter_AddRefs(child));
+        node->RemoveChild(child);
+      }
+    }
   }
 #endif