--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -3665,16 +3665,23 @@ nsDocShell::Destroy()
 
     // Make sure to blow away our mLoadingURI just in case.  No loads
     // from inside this pagehide.
     mLoadingURI = nsnull;
     
     // Fire unload event before we blow anything away.
     (void) FirePageHideNotification(PR_TRUE);
 
+    // Clear pointers to any detached nsEditorData that's lying
+    // around in shistory entries. Breaks cycle. See bug 430921.
+    if (mOSHE)
+      mOSHE->SetEditorData(nsnull);
+    if (mLSHE)
+      mLSHE->SetEditorData(nsnull);
+      
     // Note: mContentListener can be null if Init() failed and we're being
     // called from the destructor.
     if (mContentListener) {
         mContentListener->DropDocShellreference();
         mContentListener->SetParentContentListener(nsnull);
         // Note that we do NOT set mContentListener to null here; that
         // way if someone tries to do a load in us after this point
         // the nsDSURIContentListener will block it.  All of which

--- a/editor/composer/src/nsEditingSession.cpp
+++ b/editor/composer/src/nsEditingSession.cpp
@@ -1402,17 +1402,16 @@ nsEditingSession::RestoreAnimationMode(n
 }
 
 nsresult
 nsEditingSession::DetachFromWindow(nsIDOMWindow* aWindow)
 {
   if (!mDoneSetup)
     return NS_OK;
 
-  NS_ASSERTION(mEditorFlags != 0, "mEditorFlags should not be 0");
   NS_ASSERTION(mStateMaintainer, "mStateMaintainer should exist.");
 
   // Kill any existing reload timer
   if (mLoadBlankDocTimer)
   {
     mLoadBlankDocTimer->Cancel();
     mLoadBlankDocTimer = nsnull;
   }
@@ -1432,17 +1431,16 @@ nsEditingSession::DetachFromWindow(nsIDO
 }
 
 nsresult
 nsEditingSession::ReattachToWindow(nsIDOMWindow* aWindow)
 {
   if (!mDoneSetup)
     return NS_OK;
 
-  NS_ASSERTION(mEditorFlags != 0, "mEditorFlags should still be valid...");
   NS_ASSERTION(mStateMaintainer, "mStateMaintainer should exist.");
 
   // Imitate nsEditorDocShell::MakeEditable() to reattach the
   // old editor ot the window.
   nsresult rv;
 
   mWindowToBeEdited = do_GetWeakReference(aWindow);