diff --git a/mozilla/docshell/base/nsDocShell.cpp b/mozilla/docshell/base/nsDocShell.cpp
index 69ae3f26050..a5e944c1bf6 100644
--- a/mozilla/docshell/base/nsDocShell.cpp
+++ b/mozilla/docshell/base/nsDocShell.cpp
@@ -7727,7 +7727,9 @@ nsDocShell::SetHistoryEntry(nsCOMPtr<nsISHEntry> *aPtr, nsISHEntry *aEntry)
         // newRootEntry is now the new root entry.
         // Find the old root entry as well.
 
-        nsISHEntry *oldRootEntry = GetRootSHEntry(*aPtr);
+        // Need a strong ref. on |oldRootEntry| so it isn't destroyed when
+        // SetChildHistoryEntry() does SwapHistoryEntries() (bug 304639).
+        nsCOMPtr<nsISHEntry> oldRootEntry = GetRootSHEntry(*aPtr);
         if (oldRootEntry) {
             nsCOMPtr<nsIDocShellTreeItem> parentAsItem;
             GetSameTypeParent(getter_AddRefs(parentAsItem));