diff --git a/mozilla/docshell/base/nsWebShell.cpp b/mozilla/docshell/base/nsWebShell.cpp
index 774568f7273..711571baf01 100644
--- a/mozilla/docshell/base/nsWebShell.cpp
+++ b/mozilla/docshell/base/nsWebShell.cpp
@@ -171,6 +171,7 @@ public:
 	NS_IMETHOD GetParentEvenIfChrome(nsIWebShell*& aParent);
   NS_IMETHOD GetChildCount(PRInt32& aResult);
   NS_IMETHOD AddChild(nsIWebShell* aChild);
+  NS_IMETHOD RemoveChild(nsIWebShell* aChild);
   NS_IMETHOD ChildAt(PRInt32 aIndex, nsIWebShell*& aResult);
   NS_IMETHOD GetName(const PRUnichar** aName);
   NS_IMETHOD SetName(const PRUnichar* aName);
@@ -888,6 +889,11 @@ nsWebShell::Destroy()
   SetObserver(nsnull);
   SetDocLoaderObserver(nsnull);
 
+  // Remove this webshell from its parent's child list
+  if (nsnull != mParent) {
+    mParent->RemoveChild(this);
+  }
+
   if (nsnull != mDocLoader) {
     mDocLoader->SetContainer(nsnull);
   }
@@ -1214,6 +1220,20 @@ nsWebShell::AddChild(nsIWebShell* aChild)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsWebShell::RemoveChild(nsIWebShell* aChild)
+{
+  NS_PRECONDITION(nsnull != aChild, "nsWebShell::RemoveChild(): null ptr");
+  if (nsnull == aChild) {
+    return NS_ERROR_NULL_POINTER;
+  }
+  mChildren.RemoveElement(aChild);
+  aChild->SetParent(nsnull);
+  NS_RELEASE(aChild);
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsWebShell::ChildAt(PRInt32 aIndex, nsIWebShell*& aResult)
 {
diff --git a/mozilla/layout/generic/nsFrameFrame.cpp b/mozilla/layout/generic/nsFrameFrame.cpp
index 3088e3cb87a..883529598e3 100644
--- a/mozilla/layout/generic/nsFrameFrame.cpp
+++ b/mozilla/layout/generic/nsFrameFrame.cpp
@@ -432,8 +432,7 @@ nsHTMLFrameInnerFrame::~nsHTMLFrameInnerFrame()
 {
   //printf("nsHTMLFrameInnerFrame destructor %X \n", this);
   if (nsnull != mWebShell) {
-//XXX Let mWebShell's parent destroy it because now may not be a good time
-//    mWebShell->Destroy();
+    mWebShell->Destroy();    
     NS_RELEASE(mWebShell);
   }
   NS_RELEASE(mTempObserver);
diff --git a/mozilla/layout/html/document/src/nsFrameFrame.cpp b/mozilla/layout/html/document/src/nsFrameFrame.cpp
index 3088e3cb87a..883529598e3 100644
--- a/mozilla/layout/html/document/src/nsFrameFrame.cpp
+++ b/mozilla/layout/html/document/src/nsFrameFrame.cpp
@@ -432,8 +432,7 @@ nsHTMLFrameInnerFrame::~nsHTMLFrameInnerFrame()
 {
   //printf("nsHTMLFrameInnerFrame destructor %X \n", this);
   if (nsnull != mWebShell) {
-//XXX Let mWebShell's parent destroy it because now may not be a good time
-//    mWebShell->Destroy();
+    mWebShell->Destroy();    
     NS_RELEASE(mWebShell);
   }
   NS_RELEASE(mTempObserver);
diff --git a/mozilla/webshell/src/nsWebShell.cpp b/mozilla/webshell/src/nsWebShell.cpp
index 774568f7273..711571baf01 100644
--- a/mozilla/webshell/src/nsWebShell.cpp
+++ b/mozilla/webshell/src/nsWebShell.cpp
@@ -171,6 +171,7 @@ public:
 	NS_IMETHOD GetParentEvenIfChrome(nsIWebShell*& aParent);
   NS_IMETHOD GetChildCount(PRInt32& aResult);
   NS_IMETHOD AddChild(nsIWebShell* aChild);
+  NS_IMETHOD RemoveChild(nsIWebShell* aChild);
   NS_IMETHOD ChildAt(PRInt32 aIndex, nsIWebShell*& aResult);
   NS_IMETHOD GetName(const PRUnichar** aName);
   NS_IMETHOD SetName(const PRUnichar* aName);
@@ -888,6 +889,11 @@ nsWebShell::Destroy()
   SetObserver(nsnull);
   SetDocLoaderObserver(nsnull);
 
+  // Remove this webshell from its parent's child list
+  if (nsnull != mParent) {
+    mParent->RemoveChild(this);
+  }
+
   if (nsnull != mDocLoader) {
     mDocLoader->SetContainer(nsnull);
   }
@@ -1214,6 +1220,20 @@ nsWebShell::AddChild(nsIWebShell* aChild)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsWebShell::RemoveChild(nsIWebShell* aChild)
+{
+  NS_PRECONDITION(nsnull != aChild, "nsWebShell::RemoveChild(): null ptr");
+  if (nsnull == aChild) {
+    return NS_ERROR_NULL_POINTER;
+  }
+  mChildren.RemoveElement(aChild);
+  aChild->SetParent(nsnull);
+  NS_RELEASE(aChild);
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsWebShell::ChildAt(PRInt32 aIndex, nsIWebShell*& aResult)
 {