diff --git a/mozilla/docshell/base/nsDocShell.cpp b/mozilla/docshell/base/nsDocShell.cpp
index e6a855eae93..b1a74ea0f26 100644
--- a/mozilla/docshell/base/nsDocShell.cpp
+++ b/mozilla/docshell/base/nsDocShell.cpp
@@ -3555,7 +3555,11 @@ nsDocShell::Destroy()
 
     // required to break ref cycle
     mSecurityUI = nsnull;
-    
+
+    // Cancel any timers that were set for this docshell; this is needed
+    // to break the cycle between us and the timers.
+    CancelRefreshURITimers();
+
     return NS_OK;
 }
 
@@ -4437,25 +4441,32 @@ NS_IMETHODIMP nsDocShell::SetupRefreshURI(nsIChannel * aChannel)
     return rv;
 }
 
-NS_IMETHODIMP
-nsDocShell::CancelRefreshURITimers()
+static void
+DoCancelRefreshURITimers(nsISupportsArray* aTimerList)
 {
-    if (!mRefreshURIList)
-        return NS_OK;
+    if (!aTimerList)
+        return;
 
     PRUint32 n=0;
-    mRefreshURIList->Count(&n);
+    aTimerList->Count(&n);
 
     while (n) {
-        nsCOMPtr<nsISupports> element;
-        mRefreshURIList->GetElementAt(--n, getter_AddRefs(element));
-        nsCOMPtr<nsITimer> timer(do_QueryInterface(element));
+        nsCOMPtr<nsITimer> timer(do_QueryElementAt(aTimerList, --n));
 
-        mRefreshURIList->RemoveElementAt(n);    // bye bye owning timer ref
+        aTimerList->RemoveElementAt(n);    // bye bye owning timer ref
 
         if (timer)
             timer->Cancel();        
     }
+}
+
+NS_IMETHODIMP
+nsDocShell::CancelRefreshURITimers()
+{
+    DoCancelRefreshURITimers(mRefreshURIList);
+    DoCancelRefreshURITimers(mSavedRefreshURIList);
+    mRefreshURIList = nsnull;
+    mSavedRefreshURIList = nsnull;
 
     return NS_OK;
 }
diff --git a/mozilla/docshell/base/nsWebShell.cpp b/mozilla/docshell/base/nsWebShell.cpp
index 75ae7b6f291..acd32441368 100644
--- a/mozilla/docshell/base/nsWebShell.cpp
+++ b/mozilla/docshell/base/nsWebShell.cpp
@@ -179,9 +179,6 @@ nsWebShell::~nsWebShell()
 {
    Destroy();
 
-  // Cancel any timers that were set for this loader.
-  CancelRefreshURITimers();
-
   ++mRefCnt; // following releases can cause this destructor to be called
              // recursively if the refcount is allowed to remain 0