diff --git a/mozilla/layout/base/nsDocumentViewer.cpp b/mozilla/layout/base/nsDocumentViewer.cpp
index 63bcce3bf6c..58f45f2d7fb 100644
--- a/mozilla/layout/base/nsDocumentViewer.cpp
+++ b/mozilla/layout/base/nsDocumentViewer.cpp
@@ -1516,6 +1516,19 @@ DocumentViewerImpl::SetDOMDocument(nsIDOMDocument *aDocument)
     if (global) {
       global->SetNewDocument(aDocument, nsnull, PR_TRUE, PR_TRUE);
     }
+
+    // Clear the list of old child docshells. CChild docshells for the new
+    // document will be constructed as frames are created.
+    nsCOMPtr<nsIDocShellTreeNode> node = do_QueryInterface(container);
+    if (node) {
+      PRInt32 count;
+      node->GetChildCount(&count);
+      for (PRInt32 i = 0; i < count; ++i) {
+        nsCOMPtr<nsIDocShellTreeItem> child;
+        node->GetChildAt(0, getter_AddRefs(child));
+        node->RemoveChild(child);
+      }
+    }
   }
 
   rv = SyncParentSubDocMap();
diff --git a/mozilla/xpfe/components/shistory/public/nsISHEntry.idl b/mozilla/xpfe/components/shistory/public/nsISHEntry.idl
index 05c8a388cea..9a69d7d4ef5 100644
--- a/mozilla/xpfe/components/shistory/public/nsISHEntry.idl
+++ b/mozilla/xpfe/components/shistory/public/nsISHEntry.idl
@@ -82,9 +82,7 @@ interface nsISHEntry : nsIHistoryEntry
     [noscript] void setViewerBounds([const] in nsRect bounds);
 
     /**
-     * Saved child docshells corresponding to contentViewer.  There are weak
-     * references since it's assumed that the content viewer's document has
-     * an owning reference to the subdocument for each shell.  The child shells
+     * Saved child docshells corresponding to contentViewer.  The child shells
      * are restored as children of the parent docshell, in this order, when the
      * parent docshell restores a saved presentation.
      */
diff --git a/mozilla/xpfe/components/shistory/src/nsSHEntry.cpp b/mozilla/xpfe/components/shistory/src/nsSHEntry.cpp
index e3eadbe4a2e..2fc4146b027 100644
--- a/mozilla/xpfe/components/shistory/src/nsSHEntry.cpp
+++ b/mozilla/xpfe/components/shistory/src/nsSHEntry.cpp
@@ -556,16 +556,14 @@ NS_IMETHODIMP
 nsSHEntry::AddChildShell(nsIDocShellTreeItem *aShell)
 {
   NS_ASSERTION(aShell, "Null child shell added to history entry");
-  mChildShells.AppendElement(aShell);
+  mChildShells.AppendObject(aShell);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsSHEntry::ChildShellAt(PRInt32 aIndex, nsIDocShellTreeItem **aShell)
 {
-  NS_IF_ADDREF(*aShell =
-               NS_STATIC_CAST(nsIDocShellTreeItem*,
-                              mChildShells.SafeElementAt(aIndex)));
+  NS_IF_ADDREF(*aShell = mChildShells.SafeObjectAt(aIndex));
   return NS_OK;
 }
 
diff --git a/mozilla/xpfe/components/shistory/src/nsSHEntry.h b/mozilla/xpfe/components/shistory/src/nsSHEntry.h
index 421d324b856..b90db2fc161 100644
--- a/mozilla/xpfe/components/shistory/src/nsSHEntry.h
+++ b/mozilla/xpfe/components/shistory/src/nsSHEntry.h
@@ -102,7 +102,7 @@ private:
   nsISHEntry *                    mParent;  // weak reference
   nsCOMPtr<nsISupports>           mWindowState;
   nsRect                          mViewerBounds;
-  nsVoidArray                     mChildShells;
+  nsCOMArray<nsIDocShellTreeItem> mChildShells;
   nsCOMPtr<nsISupportsArray>      mRefreshURIList;
 };