diff --git a/mozilla/docshell/base/nsDocShell.cpp b/mozilla/docshell/base/nsDocShell.cpp
index 923a409a715..afd4ce6a2ce 100644
--- a/mozilla/docshell/base/nsDocShell.cpp
+++ b/mozilla/docshell/base/nsDocShell.cpp
@@ -5449,15 +5449,6 @@ nsDocShell::RestoreFromHistory()
     nsCOMPtr<nsIDOMDocument> domDoc;
     mContentViewer->GetDOMDocument(getter_AddRefs(domDoc));
 
-    nsCOMArray<nsIDocShellTreeItem> childShells;
-    PRInt32 i = 0;
-    nsCOMPtr<nsIDocShellTreeItem> child;
-    while (NS_SUCCEEDED(mLSHE->ChildShellAt(i++, getter_AddRefs(child))) &&
-           child) {
-        childShells.AppendObject(child);
-    }
-    mLSHE->ClearChildShells();
-
     // get the previous content viewer size
     nsRect oldBounds(0, 0, 0, 0);
     mLSHE->GetViewerBounds(oldBounds);
@@ -5471,6 +5462,17 @@ nsDocShell::RestoreFromHistory()
         do_QueryInterface(mContentViewer);
     rv = cv18->OpenWithEntry(windowState, mLSHE);
 
+    // Now that we're done calling OpenWithEntry, we can grab the child
+    // shell list off of mLSHE as well.
+    nsCOMArray<nsIDocShellTreeItem> childShells;
+    PRInt32 i = 0;
+    nsCOMPtr<nsIDocShellTreeItem> child;
+    while (NS_SUCCEEDED(mLSHE->ChildShellAt(i++, getter_AddRefs(child))) &&
+           child) {
+        childShells.AppendObject(child);
+    }
+    mLSHE->ClearChildShells();
+
     // Now remove it from the cached presentation.
     mLSHE->SetContentViewer(nsnull);
     mEODForCurrentDocument = PR_FALSE;
diff --git a/mozilla/docshell/base/nsIContentViewer.idl b/mozilla/docshell/base/nsIContentViewer.idl
index 1e766382fb6..b0494ca55c8 100644
--- a/mozilla/docshell/base/nsIContentViewer.idl
+++ b/mozilla/docshell/base/nsIContentViewer.idl
@@ -104,7 +104,9 @@ interface nsIContentViewer_MOZILLA_1_8_BRANCH : nsISupports
    * Attach the content viewer to its DOM window and docshell.
    * @param aState A state object that might be useful in attaching the DOM
    *               window.
-   * @param aSHEntry The history entry that the content viewer was stored in
+   * @param aSHEntry The history entry that the content viewer was stored in.
+   *                 The entry must have the docshells for all of the child
+   *                 documents stored in its child shell list.
    */
   void openWithEntry(in nsISupports aState, in nsISHEntry aSHEntry);
 };