Bug 430921 - "chrome mochitest for bug 304188 leaks the world" [p=chris@pearce.org.nz (Chris Pearce [cpearce]) r+sr=peterv a1.9=damons]

docshell/base/nsDocShell.cpp

@@ -3670,6 +3670,13 @@ nsDocShell::Destroy()
     // Fire unload event before we blow anything away.
     (void) FirePageHideNotification(PR_TRUE);
 
+    // Clear pointers to any detached nsEditorData that's lying
+    // around in shistory entries. Breaks cycle. See bug 430921.
+    if (mOSHE)
+      mOSHE->SetEditorData(nsnull);
+    if (mLSHE)
+      mLSHE->SetEditorData(nsnull);
+      
     // Note: mContentListener can be null if Init() failed and we're being
     // called from the destructor.
     if (mContentListener) {

editor/composer/src/nsEditingSession.cpp

@@ -1407,7 +1407,6 @@ nsEditingSession::DetachFromWindow(nsIDOMWindow* aWindow)
   if (!mDoneSetup)
     return NS_OK;
 
-  NS_ASSERTION(mEditorFlags != 0, "mEditorFlags should not be 0");
   NS_ASSERTION(mStateMaintainer, "mStateMaintainer should exist.");
 
   // Kill any existing reload timer
@@ -1437,7 +1436,6 @@ nsEditingSession::ReattachToWindow(nsIDOMWindow* aWindow)
   if (!mDoneSetup)
     return NS_OK;
 
-  NS_ASSERTION(mEditorFlags != 0, "mEditorFlags should still be valid...");
   NS_ASSERTION(mStateMaintainer, "mStateMaintainer should exist.");
 
   // Imitate nsEditorDocShell::MakeEditable() to reattach the