diff --git a/mozilla/docshell/base/nsWebShell.cpp b/mozilla/docshell/base/nsWebShell.cpp
index b104a17ebbc..080088485e1 100644
--- a/mozilla/docshell/base/nsWebShell.cpp
+++ b/mozilla/docshell/base/nsWebShell.cpp
@@ -311,6 +311,7 @@ protected:
   nsVoidArray mRefreshments;
 
   void ReleaseChildren();
+  void DestroyChildren();
 
   static nsIPluginHost    *mPluginHost;
   static nsIPluginManager *mPluginManager;
@@ -442,8 +443,12 @@ nsWebShell::~nsWebShell()
   }
   NS_IF_RELEASE(mScriptContext);
 
+  // XXX Because we hold references to the children and they hold references
+  // to us we never get destroyed. See Destroy() instead...
+#if 0
   // Release references on our children
   ReleaseChildren();
+#endif
 
   // Free up history memory
   PRInt32 i, n = mHistory.Count();
@@ -470,6 +475,19 @@ nsWebShell::ReleaseChildren()
   mChildren.Clear();
 }
 
+void
+nsWebShell::DestroyChildren()
+{
+  PRInt32 i, n = mChildren.Count();
+  for (i = 0; i < n; i++) {
+    nsIWebShell* shell = (nsIWebShell*) mChildren.ElementAt(i);
+    shell->SetParent(nsnull);
+    shell->Destroy();
+    NS_RELEASE(shell);
+  }
+  mChildren.Clear();
+}
+
 NS_IMPL_THREADSAFE_ADDREF(nsWebShell)
 NS_IMPL_THREADSAFE_RELEASE(nsWebShell)
 
@@ -704,6 +722,8 @@ nsWebShell::Destroy()
 
   NS_IF_RELEASE(mContentViewer);
 
+  // Destroy our child web shells and release references to them
+  DestroyChildren();
   return rv;
 }
 
diff --git a/mozilla/webshell/src/nsWebShell.cpp b/mozilla/webshell/src/nsWebShell.cpp
index b104a17ebbc..080088485e1 100644
--- a/mozilla/webshell/src/nsWebShell.cpp
+++ b/mozilla/webshell/src/nsWebShell.cpp
@@ -311,6 +311,7 @@ protected:
   nsVoidArray mRefreshments;
 
   void ReleaseChildren();
+  void DestroyChildren();
 
   static nsIPluginHost    *mPluginHost;
   static nsIPluginManager *mPluginManager;
@@ -442,8 +443,12 @@ nsWebShell::~nsWebShell()
   }
   NS_IF_RELEASE(mScriptContext);
 
+  // XXX Because we hold references to the children and they hold references
+  // to us we never get destroyed. See Destroy() instead...
+#if 0
   // Release references on our children
   ReleaseChildren();
+#endif
 
   // Free up history memory
   PRInt32 i, n = mHistory.Count();
@@ -470,6 +475,19 @@ nsWebShell::ReleaseChildren()
   mChildren.Clear();
 }
 
+void
+nsWebShell::DestroyChildren()
+{
+  PRInt32 i, n = mChildren.Count();
+  for (i = 0; i < n; i++) {
+    nsIWebShell* shell = (nsIWebShell*) mChildren.ElementAt(i);
+    shell->SetParent(nsnull);
+    shell->Destroy();
+    NS_RELEASE(shell);
+  }
+  mChildren.Clear();
+}
+
 NS_IMPL_THREADSAFE_ADDREF(nsWebShell)
 NS_IMPL_THREADSAFE_RELEASE(nsWebShell)
 
@@ -704,6 +722,8 @@ nsWebShell::Destroy()
 
   NS_IF_RELEASE(mContentViewer);
 
+  // Destroy our child web shells and release references to them
+  DestroyChildren();
   return rv;
 }