diff --git a/mozilla/docshell/base/nsDocShell.cpp b/mozilla/docshell/base/nsDocShell.cpp
index af214523f18..898ce1e8f85 100644
--- a/mozilla/docshell/base/nsDocShell.cpp
+++ b/mozilla/docshell/base/nsDocShell.cpp
@@ -3442,6 +3442,9 @@ nsDocShell::Destroy()
         mContentListener->SetParentContentListener(nsnull);
     }
 
+    // required to break ref cycle
+    mSecurityUI = nsnull;
+    
     return NS_OK;
 }
 
diff --git a/mozilla/docshell/base/nsWebShell.cpp b/mozilla/docshell/base/nsWebShell.cpp
index 94ac9f000f2..79ce7311935 100644
--- a/mozilla/docshell/base/nsWebShell.cpp
+++ b/mozilla/docshell/base/nsWebShell.cpp
@@ -166,7 +166,7 @@ nsWebShell::nsWebShell() : nsDocShell()
   ++gNumberOfWebShells;
 #endif
 #ifdef DEBUG
-    printf("++WEBSHELL == %ld\n", gNumberOfWebShells);
+    printf("++WEBSHELL %p == %ld\n", this, gNumberOfWebShells);
 #endif
 
   mThread = nsnull;
@@ -195,7 +195,7 @@ nsWebShell::~nsWebShell()
   --gNumberOfWebShells;
 #endif
 #ifdef DEBUG
-  printf("--WEBSHELL == %ld\n", gNumberOfWebShells);
+  printf("--WEBSHELL %p == %ld\n", this, gNumberOfWebShells);
 #endif
 }
 
diff --git a/mozilla/embedding/browser/webBrowser/nsWebBrowser.cpp b/mozilla/embedding/browser/webBrowser/nsWebBrowser.cpp
index 283ae7cb073..e6e3197c7de 100644
--- a/mozilla/embedding/browser/webBrowser/nsWebBrowser.cpp
+++ b/mozilla/embedding/browser/webBrowser/nsWebBrowser.cpp
@@ -1215,6 +1215,9 @@ NS_IMETHODIMP nsWebBrowser::Create()
    rv = GetContentDOMWindow(getter_AddRefs(domWindow));
    if (NS_SUCCEEDED(rv))
    {
+       // this works because the implementation of nsISecureBrowserUI
+       // (nsSecureBrowserUIImpl) gets a docShell from the domWindow,
+       // and calls docShell->SetSecurityUI(this);
        nsCOMPtr<nsISecureBrowserUI> securityUI =
            do_CreateInstance(NS_SECURE_BROWSER_UI_CONTRACTID, &rv);
        if (NS_SUCCEEDED(rv)) securityUI->Init(domWindow);
diff --git a/mozilla/toolkit/content/widgets/browser.xml b/mozilla/toolkit/content/widgets/browser.xml
index ce1f322a0c1..f2814a2088d 100644
--- a/mozilla/toolkit/content/widgets/browser.xml
+++ b/mozilla/toolkit/content/widgets/browser.xml
@@ -603,7 +603,6 @@
 
           this.detachFormFill();
           
-          this.securityUI = null;
           this._fastFind = null;
           this._webBrowserFind = null;