diff --git a/mozilla/docshell/base/nsDocShell.cpp b/mozilla/docshell/base/nsDocShell.cpp
index 3da1422f09f..fbaad68cac9 100644
--- a/mozilla/docshell/base/nsDocShell.cpp
+++ b/mozilla/docshell/base/nsDocShell.cpp
@@ -3670,6 +3670,13 @@ nsDocShell::Destroy()
     // Fire unload event before we blow anything away.
     (void) FirePageHideNotification(PR_TRUE);
 
+    // Clear pointers to any detached nsEditorData that's lying
+    // around in shistory entries. Breaks cycle. See bug 430921.
+    if (mOSHE)
+      mOSHE->SetEditorData(nsnull);
+    if (mLSHE)
+      mLSHE->SetEditorData(nsnull);
+      
     // Note: mContentListener can be null if Init() failed and we're being
     // called from the destructor.
     if (mContentListener) {
diff --git a/mozilla/editor/composer/src/nsEditingSession.cpp b/mozilla/editor/composer/src/nsEditingSession.cpp
index 56862f20207..565e9117485 100644
--- a/mozilla/editor/composer/src/nsEditingSession.cpp
+++ b/mozilla/editor/composer/src/nsEditingSession.cpp
@@ -1407,7 +1407,6 @@ nsEditingSession::DetachFromWindow(nsIDOMWindow* aWindow)
   if (!mDoneSetup)
     return NS_OK;
 
-  NS_ASSERTION(mEditorFlags != 0, "mEditorFlags should not be 0");
   NS_ASSERTION(mStateMaintainer, "mStateMaintainer should exist.");
 
   // Kill any existing reload timer
@@ -1437,7 +1436,6 @@ nsEditingSession::ReattachToWindow(nsIDOMWindow* aWindow)
   if (!mDoneSetup)
     return NS_OK;
 
-  NS_ASSERTION(mEditorFlags != 0, "mEditorFlags should still be valid...");
   NS_ASSERTION(mStateMaintainer, "mStateMaintainer should exist.");
 
   // Imitate nsEditorDocShell::MakeEditable() to reattach the