diff --git a/content/xul/content/src/nsXULElement.cpp b/content/xul/content/src/nsXULElement.cpp
index bc503a48b80f..d06c82008898 100644
--- a/content/xul/content/src/nsXULElement.cpp
+++ b/content/xul/content/src/nsXULElement.cpp
@@ -694,7 +694,6 @@ RDFElementImpl::~RDFElementImpl()
     NS_IF_RELEASE(mListenerManager);
 
     if (mChildren) {
-#if 0
         // Force child's parent to be null. This ensures that we don't
         // have dangling pointers if a child gets leaked.
         PRUint32 cnt;
@@ -706,7 +705,6 @@ RDFElementImpl::~RDFElementImpl()
 
             child->SetParent(nsnull);
         }
-#endif
         NS_RELEASE(mChildren);
     }
 
diff --git a/docshell/base/nsWebShell.cpp b/docshell/base/nsWebShell.cpp
index 1953debe8652..a740b90d8743 100644
--- a/docshell/base/nsWebShell.cpp
+++ b/docshell/base/nsWebShell.cpp
@@ -4210,7 +4210,6 @@ nsWebShellFactory::nsWebShellFactory()
 
 nsWebShellFactory::~nsWebShellFactory()
 {
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 nsresult
diff --git a/netwerk/mime/src/nsMIMEServiceFactory.cpp b/netwerk/mime/src/nsMIMEServiceFactory.cpp
index 0c0a98091800..62289bba2541 100644
--- a/netwerk/mime/src/nsMIMEServiceFactory.cpp
+++ b/netwerk/mime/src/nsMIMEServiceFactory.cpp
@@ -334,7 +334,6 @@ nsMIMEServiceFactory::nsMIMEServiceFactory(const nsCID &aClass,
 
 nsMIMEServiceFactory::~nsMIMEServiceFactory()
 {
-    NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMETHODIMP
diff --git a/netwerk/protocol/http/src/nsHTTPHandlerFactory.cpp b/netwerk/protocol/http/src/nsHTTPHandlerFactory.cpp
index 7c10fdee0203..5ce2f7a79f19 100644
--- a/netwerk/protocol/http/src/nsHTTPHandlerFactory.cpp
+++ b/netwerk/protocol/http/src/nsHTTPHandlerFactory.cpp
@@ -50,7 +50,6 @@ nsHTTPHandlerFactory::nsHTTPHandlerFactory(const nsCID &aClass)
 
 nsHTTPHandlerFactory::~nsHTTPHandlerFactory()
 {
-    NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMETHODIMP
diff --git a/netwerk/streamconv/converters/nsFTPDirListingConv.cpp b/netwerk/streamconv/converters/nsFTPDirListingConv.cpp
index 944d735fd4ee..4338c919e4fa 100644
--- a/netwerk/streamconv/converters/nsFTPDirListingConv.cpp
+++ b/netwerk/streamconv/converters/nsFTPDirListingConv.cpp
@@ -1017,7 +1017,6 @@ FTPDirListingFactory::FTPDirListingFactory(const nsCID &aClass,
 
 FTPDirListingFactory::~FTPDirListingFactory()
 {
-    NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMPL_ISUPPORTS(FTPDirListingFactory, NS_GET_IID(nsIFactory));
diff --git a/netwerk/streamconv/converters/nsMultiMixedConv.cpp b/netwerk/streamconv/converters/nsMultiMixedConv.cpp
index 00619395cb55..8aadd2158616 100644
--- a/netwerk/streamconv/converters/nsMultiMixedConv.cpp
+++ b/netwerk/streamconv/converters/nsMultiMixedConv.cpp
@@ -383,7 +383,6 @@ MultiMixedFactory::MultiMixedFactory(const nsCID &aClass,
 
 MultiMixedFactory::~MultiMixedFactory()
 {
-    NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMPL_ISUPPORTS(MultiMixedFactory, NS_GET_IID(nsIFactory));
diff --git a/netwerk/streamconv/test/Converters.cpp b/netwerk/streamconv/test/Converters.cpp
index 504c0f3a281e..8253cfa21370 100644
--- a/netwerk/streamconv/test/Converters.cpp
+++ b/netwerk/streamconv/test/Converters.cpp
@@ -116,7 +116,6 @@ TestConverterFactory::TestConverterFactory(const nsCID &aClass,
 
 TestConverterFactory::~TestConverterFactory()
 {
-    NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMPL_ISUPPORTS(TestConverterFactory, NS_GET_IID(nsIFactory));
diff --git a/netwerk/test/TestStreamConv.cpp b/netwerk/test/TestStreamConv.cpp
index 7b88cfefa5c9..022199f901d4 100644
--- a/netwerk/test/TestStreamConv.cpp
+++ b/netwerk/test/TestStreamConv.cpp
@@ -132,7 +132,6 @@ TestConverterFactory::TestConverterFactory(const nsCID &aClass,
 
 TestConverterFactory::~TestConverterFactory()
 {
-    NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMETHODIMP
diff --git a/network/module/nsNetFactory.cpp b/network/module/nsNetFactory.cpp
index 5325a1eb6297..a0f8b92a7966 100644
--- a/network/module/nsNetFactory.cpp
+++ b/network/module/nsNetFactory.cpp
@@ -73,7 +73,6 @@ nsNetFactory::nsNetFactory(const nsCID &aClass)
 
 nsNetFactory::~nsNetFactory()   
 {   
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");   
 }   
 
 nsresult nsNetFactory::QueryInterface(const nsIID &aIID,   
diff --git a/profile/Acctidl/nsAccountServicesFactory.cpp b/profile/Acctidl/nsAccountServicesFactory.cpp
index cbe2f75282b9..6111717a690a 100644
--- a/profile/Acctidl/nsAccountServicesFactory.cpp
+++ b/profile/Acctidl/nsAccountServicesFactory.cpp
@@ -71,7 +71,6 @@ AccountServicesFactoryImpl::AccountServicesFactoryImpl(const nsCID &aClass,
 
 AccountServicesFactoryImpl::~AccountServicesFactoryImpl()
 {
-    NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMETHODIMP
diff --git a/rdf/content/src/nsRDFElement.cpp b/rdf/content/src/nsRDFElement.cpp
index bc503a48b80f..d06c82008898 100644
--- a/rdf/content/src/nsRDFElement.cpp
+++ b/rdf/content/src/nsRDFElement.cpp
@@ -694,7 +694,6 @@ RDFElementImpl::~RDFElementImpl()
     NS_IF_RELEASE(mListenerManager);
 
     if (mChildren) {
-#if 0
         // Force child's parent to be null. This ensures that we don't
         // have dangling pointers if a child gets leaked.
         PRUint32 cnt;
@@ -706,7 +705,6 @@ RDFElementImpl::~RDFElementImpl()
 
             child->SetParent(nsnull);
         }
-#endif
         NS_RELEASE(mChildren);
     }
 
diff --git a/rdf/content/src/nsXULElement.cpp b/rdf/content/src/nsXULElement.cpp
index bc503a48b80f..d06c82008898 100644
--- a/rdf/content/src/nsXULElement.cpp
+++ b/rdf/content/src/nsXULElement.cpp
@@ -694,7 +694,6 @@ RDFElementImpl::~RDFElementImpl()
     NS_IF_RELEASE(mListenerManager);
 
     if (mChildren) {
-#if 0
         // Force child's parent to be null. This ensures that we don't
         // have dangling pointers if a child gets leaked.
         PRUint32 cnt;
@@ -706,7 +705,6 @@ RDFElementImpl::~RDFElementImpl()
 
             child->SetParent(nsnull);
         }
-#endif
         NS_RELEASE(mChildren);
     }
 
diff --git a/view/src/nsViewFactory.cpp b/view/src/nsViewFactory.cpp
index 7d92ec0ec2f5..6564401d8926 100644
--- a/view/src/nsViewFactory.cpp
+++ b/view/src/nsViewFactory.cpp
@@ -63,7 +63,6 @@ nsViewFactory::nsViewFactory(const nsCID &aClass)
 
 nsViewFactory::~nsViewFactory()   
 {   
-	NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");   
 }   
 
 NS_IMPL_ISUPPORTS1(nsViewFactory, nsIFactory)
diff --git a/webshell/src/nsWebShell.cpp b/webshell/src/nsWebShell.cpp
index 1953debe8652..a740b90d8743 100644
--- a/webshell/src/nsWebShell.cpp
+++ b/webshell/src/nsWebShell.cpp
@@ -4210,7 +4210,6 @@ nsWebShellFactory::nsWebShellFactory()
 
 nsWebShellFactory::~nsWebShellFactory()
 {
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 nsresult
diff --git a/webshell/tests/viewer/nsBrowserWindow.cpp b/webshell/tests/viewer/nsBrowserWindow.cpp
index 8081e84fe00e..1b6c5c9e58ac 100644
--- a/webshell/tests/viewer/nsBrowserWindow.cpp
+++ b/webshell/tests/viewer/nsBrowserWindow.cpp
@@ -3424,7 +3424,6 @@ nsBrowserWindowFactory::nsBrowserWindowFactory()
 
 nsBrowserWindowFactory::~nsBrowserWindowFactory()
 {
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 nsresult
diff --git a/webshell/tests/viewer/nsXPBaseWindow.cpp b/webshell/tests/viewer/nsXPBaseWindow.cpp
index af0a32f38f36..246ca03bfd17 100644
--- a/webshell/tests/viewer/nsXPBaseWindow.cpp
+++ b/webshell/tests/viewer/nsXPBaseWindow.cpp
@@ -782,7 +782,6 @@ nsXPBaseWindowFactory::nsXPBaseWindowFactory()
 //----------------------------------------------------------------------
 nsXPBaseWindowFactory::~nsXPBaseWindowFactory()
 {
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 //----------------------------------------------------------------------
diff --git a/widget/src/beos/nsWidgetFactory.cpp b/widget/src/beos/nsWidgetFactory.cpp
index 2f131d48976b..347be6b690ab 100644
--- a/widget/src/beos/nsWidgetFactory.cpp
+++ b/widget/src/beos/nsWidgetFactory.cpp
@@ -121,7 +121,6 @@ nsWidgetFactory::nsWidgetFactory(const nsCID &aClass)
 
 nsWidgetFactory::~nsWidgetFactory()   
 {   
-  NS_ASSERTION(mRefCnt == 0, "Reference count not zero in destructor");
 }   
 
 nsresult nsWidgetFactory::QueryInterface(const nsIID &aIID,   
diff --git a/widget/src/build/nsWinWidgetFactory.cpp b/widget/src/build/nsWinWidgetFactory.cpp
index 4dbda5e09be7..32698426fb4a 100644
--- a/widget/src/build/nsWinWidgetFactory.cpp
+++ b/widget/src/build/nsWinWidgetFactory.cpp
@@ -243,9 +243,6 @@ nsWidgetFactory::nsWidgetFactory(const nsCID &aClass)
 nsWidgetFactory::~nsWidgetFactory()   
 
 {   
-
-    NS_ASSERTION(mRefCnt == 0, "Reference count not zero in destructor");   
-
 }   
 
 
diff --git a/widget/src/gtk/nsWidgetFactory.cpp b/widget/src/gtk/nsWidgetFactory.cpp
index b2d843762925..2a941a5d9776 100644
--- a/widget/src/gtk/nsWidgetFactory.cpp
+++ b/widget/src/gtk/nsWidgetFactory.cpp
@@ -125,7 +125,6 @@ nsWidgetFactory::nsWidgetFactory(const nsCID &aClass)
 
 nsWidgetFactory::~nsWidgetFactory()   
 {   
-  NS_ASSERTION(mRefCnt == 0, "Reference count not zero in destructor");
 }   
 
 nsresult nsWidgetFactory::QueryInterface(const nsIID &aIID,   
diff --git a/widget/src/motif/app_context/nsMotifAppContextServiceFactory.cpp b/widget/src/motif/app_context/nsMotifAppContextServiceFactory.cpp
index 4bece4d8923e..5a0973b6ac6e 100644
--- a/widget/src/motif/app_context/nsMotifAppContextServiceFactory.cpp
+++ b/widget/src/motif/app_context/nsMotifAppContextServiceFactory.cpp
@@ -53,7 +53,6 @@ nsMotifAppContextServiceFactory::nsMotifAppContextServiceFactory(const nsCID &aC
 
 nsMotifAppContextServiceFactory::~nsMotifAppContextServiceFactory()
 {
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMPL_ISUPPORTS(nsMotifAppContextServiceFactory, nsIFactory::GetIID())
diff --git a/widget/src/motif/nsWidgetFactory.cpp b/widget/src/motif/nsWidgetFactory.cpp
index 25757892f775..eeab71128f6e 100644
--- a/widget/src/motif/nsWidgetFactory.cpp
+++ b/widget/src/motif/nsWidgetFactory.cpp
@@ -123,7 +123,6 @@ nsWidgetFactory::nsWidgetFactory(const nsCID &aClass)
 
 nsWidgetFactory::~nsWidgetFactory()   
 {   
-  NS_ASSERTION(mRefCnt == 0, "Reference count not zero in destructor");
 }   
 
 nsresult nsWidgetFactory::QueryInterface(const nsIID &aIID,   
diff --git a/widget/src/photon/nsWidgetFactory.cpp b/widget/src/photon/nsWidgetFactory.cpp
index 2dca4edeeadb..c9ba92436042 100644
--- a/widget/src/photon/nsWidgetFactory.cpp
+++ b/widget/src/photon/nsWidgetFactory.cpp
@@ -135,8 +135,6 @@ nsWidgetFactory::nsWidgetFactory(const nsCID &aClass)
 nsWidgetFactory::~nsWidgetFactory()   
 {   
   PR_LOG(PhWidLog, PR_LOG_DEBUG,("nsWidgetFactory::~nsWidgetFactory Destructor Called\n"));
-
-  NS_ASSERTION(mRefCnt == 0, "Reference count not zero in destructor");
 }   
 
 nsresult nsWidgetFactory::QueryInterface(const nsIID &aIID,   
diff --git a/widget/src/qt/nsWidgetFactory.cpp b/widget/src/qt/nsWidgetFactory.cpp
index ef04a5919ac3..9c282c94e9fe 100644
--- a/widget/src/qt/nsWidgetFactory.cpp
+++ b/widget/src/qt/nsWidgetFactory.cpp
@@ -127,7 +127,6 @@ nsWidgetFactory::nsWidgetFactory(const nsCID &aClass)
 
 nsWidgetFactory::~nsWidgetFactory()   
 {   
-    NS_ASSERTION(mRefCnt == 0, "Reference count not zero in destructor");
 }   
 
 nsresult nsWidgetFactory::QueryInterface(const nsIID &aIID,   
diff --git a/widget/src/unix_services/toolkit_service/nsUnixToolkitServiceFactory.cpp b/widget/src/unix_services/toolkit_service/nsUnixToolkitServiceFactory.cpp
index b74c9b0d202d..d5aa1da3b1e5 100644
--- a/widget/src/unix_services/toolkit_service/nsUnixToolkitServiceFactory.cpp
+++ b/widget/src/unix_services/toolkit_service/nsUnixToolkitServiceFactory.cpp
@@ -53,7 +53,6 @@ nsUnixToolkitServiceFactory::nsUnixToolkitServiceFactory(const nsCID &aClass) :
 
 nsUnixToolkitServiceFactory::~nsUnixToolkitServiceFactory()
 {
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMPL_ISUPPORTS(nsUnixToolkitServiceFactory, nsIFactory::GetIID())
diff --git a/widget/src/xlib/nsWidgetFactory.cpp b/widget/src/xlib/nsWidgetFactory.cpp
index a9cb90e4af22..452681d1e14e 100644
--- a/widget/src/xlib/nsWidgetFactory.cpp
+++ b/widget/src/xlib/nsWidgetFactory.cpp
@@ -100,7 +100,6 @@ nsWidgetFactory::nsWidgetFactory(const nsCID &aClass)
 
 nsWidgetFactory::~nsWidgetFactory()
 {
-  NS_ASSERTION(mRefCnt == 0, "Reference count not zero in destructor");   
 }
 
 nsresult nsWidgetFactory::QueryInterface(const nsIID &aIID,
diff --git a/widget/src/xlib/window_service/nsXlibWindowServiceFactory.cpp b/widget/src/xlib/window_service/nsXlibWindowServiceFactory.cpp
index b46ff21f0b84..dd17c5e8bbf8 100644
--- a/widget/src/xlib/window_service/nsXlibWindowServiceFactory.cpp
+++ b/widget/src/xlib/window_service/nsXlibWindowServiceFactory.cpp
@@ -54,7 +54,6 @@ nsXlibWindowServiceFactory::nsXlibWindowServiceFactory(const nsCID &aClass) :
 
 nsXlibWindowServiceFactory::~nsXlibWindowServiceFactory()
 {
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMPL_ISUPPORTS(nsXlibWindowServiceFactory, nsIFactory::GetIID())
diff --git a/widget/timer/src/unix/gtk/nsTimerGtkFactory.cpp b/widget/timer/src/unix/gtk/nsTimerGtkFactory.cpp
index 2b64613f4485..81769f9b6eb1 100644
--- a/widget/timer/src/unix/gtk/nsTimerGtkFactory.cpp
+++ b/widget/timer/src/unix/gtk/nsTimerGtkFactory.cpp
@@ -56,7 +56,6 @@ nsTimerGtkFactory::nsTimerGtkFactory(const nsCID &aClass) :
 
 nsTimerGtkFactory::~nsTimerGtkFactory()   
 {   
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");   
 }   
 
 NS_IMPL_ISUPPORTS(nsTimerGtkFactory, nsIFactory::GetIID())
diff --git a/widget/timer/src/unix/motif/nsTimerMotifFactory.cpp b/widget/timer/src/unix/motif/nsTimerMotifFactory.cpp
index 677cfa29a793..4c039664260a 100644
--- a/widget/timer/src/unix/motif/nsTimerMotifFactory.cpp
+++ b/widget/timer/src/unix/motif/nsTimerMotifFactory.cpp
@@ -56,7 +56,6 @@ nsTimerMotifFactory::nsTimerMotifFactory(const nsCID &aClass) :
 
 nsTimerMotifFactory::~nsTimerMotifFactory()   
 {   
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");   
 }   
 
 NS_IMPL_ISUPPORTS(nsTimerMotifFactory, nsIFactory::GetIID())
diff --git a/widget/timer/src/unix/qt/nsTimerQtFactory.cpp b/widget/timer/src/unix/qt/nsTimerQtFactory.cpp
index e0f0ceb2f626..0686caa94013 100644
--- a/widget/timer/src/unix/qt/nsTimerQtFactory.cpp
+++ b/widget/timer/src/unix/qt/nsTimerQtFactory.cpp
@@ -56,7 +56,6 @@ nsTimerQtFactory::nsTimerQtFactory(const nsCID &aClass) :
 
 nsTimerQtFactory::~nsTimerQtFactory()   
 {   
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");   
 }   
 
 NS_IMPL_ISUPPORTS(nsTimerQtFactory, nsIFactory::GetIID())
diff --git a/widget/timer/src/unix/xlib/nsTimerXlibFactory.cpp b/widget/timer/src/unix/xlib/nsTimerXlibFactory.cpp
index cd289f2a029c..ffdb90e159f4 100644
--- a/widget/timer/src/unix/xlib/nsTimerXlibFactory.cpp
+++ b/widget/timer/src/unix/xlib/nsTimerXlibFactory.cpp
@@ -56,7 +56,6 @@ nsTimerXlibFactory::nsTimerXlibFactory(const nsCID &aClass) :
 
 nsTimerXlibFactory::~nsTimerXlibFactory()   
 {   
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");   
 }   
 
 NS_IMPL_ISUPPORTS(nsTimerXlibFactory, nsIFactory::GetIID())
diff --git a/xpcom/base/nsAgg.h b/xpcom/base/nsAgg.h
index c2b3741ed07c..33a062d065f2 100644
--- a/xpcom/base/nsAgg.h
+++ b/xpcom/base/nsAgg.h
@@ -112,6 +112,7 @@ _class::Internal::Release(void)                                             \
     --agg->mRefCnt;                                                         \
     NS_LOG_RELEASE(this, agg->mRefCnt, #_class);                            \
     if (agg->mRefCnt == 0) {                                                \
+        agg->mRefCnt = 1; /* stabilize */                                   \
         NS_DELETEXPCOM(agg);                                                \
         return 0;                                                           \
     }                                                                       \
diff --git a/xpcom/base/nsISupportsUtils.h b/xpcom/base/nsISupportsUtils.h
index 54aad2b905e5..2c4127013382 100644
--- a/xpcom/base/nsISupportsUtils.h
+++ b/xpcom/base/nsISupportsUtils.h
@@ -200,6 +200,15 @@ NS_IMETHODIMP_(nsrefcnt) _class::AddRef(void)                \
 /**
  * Use this macro to implement the Release method for a given <i>_class</i>
  * @param _class The name of the class implementing the method
+ *
+ * A note on the 'stabilization' of the refcnt to one. At that point,
+ * the object's refcount will have gone to zero. The object's
+ * destructor may trigger code that attempts to QueryInterface() and
+ * Release() 'this' again. Doing so will temporarily increment and
+ * decrement the refcount. (Only a logic error would make one try to
+ * keep a permanent hold on 'this'.)  To prevent re-entering the
+ * destructor, we make sure that no balanced refcounting can return
+ * the refcount to |0|.
  */
 #define NS_IMPL_RELEASE(_class)                              \
 NS_IMETHODIMP_(nsrefcnt) _class::Release(void)               \
@@ -208,6 +217,7 @@ NS_IMETHODIMP_(nsrefcnt) _class::Release(void)               \
   --mRefCnt;                                                 \
   NS_LOG_RELEASE(this, mRefCnt, #_class);                    \
   if (mRefCnt == 0) {                                        \
+    mRefCnt = 1; /* stabilize */                             \
     NS_DELETEXPCOM(this);                                    \
     return 0;                                                \
   }                                                          \
diff --git a/xpcom/components/nsXPComFactory.h b/xpcom/components/nsXPComFactory.h
index 0354ae8b8208..edc04fb15242 100644
--- a/xpcom/components/nsXPComFactory.h
+++ b/xpcom/components/nsXPComFactory.h
@@ -110,10 +110,7 @@ public:                                                           \
   }                                                               \
                                                                   \
 protected:                                                        \
-  virtual ~ns##_name##Factory()                                   \
-  {                                                               \
-    NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction"); \
-  }                                                               \
+  virtual ~ns##_name##Factory() {}                                \
 };                                                                \
 NS_IMPL_ISUPPORTS1(ns##_name##Factory, nsIFactory);
 
diff --git a/xpcom/glue/nsISupportsUtils.h b/xpcom/glue/nsISupportsUtils.h
index 54aad2b905e5..2c4127013382 100644
--- a/xpcom/glue/nsISupportsUtils.h
+++ b/xpcom/glue/nsISupportsUtils.h
@@ -200,6 +200,15 @@ NS_IMETHODIMP_(nsrefcnt) _class::AddRef(void)                \
 /**
  * Use this macro to implement the Release method for a given <i>_class</i>
  * @param _class The name of the class implementing the method
+ *
+ * A note on the 'stabilization' of the refcnt to one. At that point,
+ * the object's refcount will have gone to zero. The object's
+ * destructor may trigger code that attempts to QueryInterface() and
+ * Release() 'this' again. Doing so will temporarily increment and
+ * decrement the refcount. (Only a logic error would make one try to
+ * keep a permanent hold on 'this'.)  To prevent re-entering the
+ * destructor, we make sure that no balanced refcounting can return
+ * the refcount to |0|.
  */
 #define NS_IMPL_RELEASE(_class)                              \
 NS_IMETHODIMP_(nsrefcnt) _class::Release(void)               \
@@ -208,6 +217,7 @@ NS_IMETHODIMP_(nsrefcnt) _class::Release(void)               \
   --mRefCnt;                                                 \
   NS_LOG_RELEASE(this, mRefCnt, #_class);                    \
   if (mRefCnt == 0) {                                        \
+    mRefCnt = 1; /* stabilize */                             \
     NS_DELETEXPCOM(this);                                    \
     return 0;                                                \
   }                                                          \
diff --git a/xpcom/sample/nsSampleFactory.cpp b/xpcom/sample/nsSampleFactory.cpp
index 94fe9c92b609..14bf56a52453 100644
--- a/xpcom/sample/nsSampleFactory.cpp
+++ b/xpcom/sample/nsSampleFactory.cpp
@@ -119,7 +119,6 @@ SampleFactoryImpl::SampleFactoryImpl(const nsCID &aClass,
 
 SampleFactoryImpl::~SampleFactoryImpl()
 {
-    NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 /**
diff --git a/xpfe/apprunner/src/nsAppRunnerImpl.cpp b/xpfe/apprunner/src/nsAppRunnerImpl.cpp
index a7459bb8f599..b6b3c894dd21 100644
--- a/xpfe/apprunner/src/nsAppRunnerImpl.cpp
+++ b/xpfe/apprunner/src/nsAppRunnerImpl.cpp
@@ -325,7 +325,6 @@ nsAppRunnerFactory::nsAppRunnerFactory() {
 }
 
 nsAppRunnerFactory::~nsAppRunnerFactory() {
-    NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMPL_ISUPPORTS(nsAppRunnerFactory, kIFactoryIID);
diff --git a/xpfe/appshell/src/nsCommandLineService.cpp b/xpfe/appshell/src/nsCommandLineService.cpp
index a78aab632cd2..b164a7fa9f5b 100644
--- a/xpfe/appshell/src/nsCommandLineService.cpp
+++ b/xpfe/appshell/src/nsCommandLineService.cpp
@@ -318,7 +318,6 @@ nsCmdLineServiceFactory::LockFactory(PRBool lock)
 
 nsCmdLineServiceFactory::~nsCmdLineServiceFactory()
 {
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMPL_ISUPPORTS(nsCmdLineServiceFactory, kIFactoryIID);
diff --git a/xpfe/appshell/src/nsFileLocations.cpp b/xpfe/appshell/src/nsFileLocations.cpp
index 319c0711baa9..54baf68e97f5 100644
--- a/xpfe/appshell/src/nsFileLocations.cpp
+++ b/xpfe/appshell/src/nsFileLocations.cpp
@@ -628,7 +628,6 @@ nsresult nsFileLocatorFactory::LockFactory(PRBool /*lock*/)
 nsFileLocatorFactory::~nsFileLocatorFactory()
 //----------------------------------------------------------------------------------------
 {
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMPL_ISUPPORTS(nsFileLocatorFactory, kIFactoryIID);
diff --git a/xpfe/appshell/src/nsNetSupportDialog.cpp b/xpfe/appshell/src/nsNetSupportDialog.cpp
index 7c451becd7b4..70c4402f5ab3 100644
--- a/xpfe/appshell/src/nsNetSupportDialog.cpp
+++ b/xpfe/appshell/src/nsNetSupportDialog.cpp
@@ -841,7 +841,6 @@ nsNetSupportDialogFactory::LockFactory(PRBool lock)
 
 nsNetSupportDialogFactory::~nsNetSupportDialogFactory()
 {
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMPL_ISUPPORTS(nsNetSupportDialogFactory, kIFactoryIID);
diff --git a/xpfe/appshell/src/nsSessionHistory.cpp b/xpfe/appshell/src/nsSessionHistory.cpp
index 0c4c76ab3dd9..e75875fd8871 100644
--- a/xpfe/appshell/src/nsSessionHistory.cpp
+++ b/xpfe/appshell/src/nsSessionHistory.cpp
@@ -1508,7 +1508,6 @@ nsSessionHistoryFactory::LockFactory(PRBool aLock)
 
 nsSessionHistoryFactory::~nsSessionHistoryFactory()
 {
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMPL_ISUPPORTS(nsSessionHistoryFactory, kIFactoryIID);
diff --git a/xpfe/components/prefwindow/src/nsPrefWindowFactory.cpp b/xpfe/components/prefwindow/src/nsPrefWindowFactory.cpp
index 1c16cd577549..dba25cfd54f7 100644
--- a/xpfe/components/prefwindow/src/nsPrefWindowFactory.cpp
+++ b/xpfe/components/prefwindow/src/nsPrefWindowFactory.cpp
@@ -73,7 +73,6 @@ nsPrefWindowFactory::nsPrefWindowFactory(
 nsPrefWindowFactory::~nsPrefWindowFactory()   
 //----------------------------------------------------------------------------------------
 {
-	NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");   
 //	nsCRT::free(mClassName);
 //	nsCRT::free(mProgID);
 }   
diff --git a/xpfe/components/startup/src/nsCommandLineService.cpp b/xpfe/components/startup/src/nsCommandLineService.cpp
index a78aab632cd2..b164a7fa9f5b 100644
--- a/xpfe/components/startup/src/nsCommandLineService.cpp
+++ b/xpfe/components/startup/src/nsCommandLineService.cpp
@@ -318,7 +318,6 @@ nsCmdLineServiceFactory::LockFactory(PRBool lock)
 
 nsCmdLineServiceFactory::~nsCmdLineServiceFactory()
 {
-  NS_ASSERTION(mRefCnt == 0, "non-zero refcnt at destruction");
 }
 
 NS_IMPL_ISUPPORTS(nsCmdLineServiceFactory, kIFactoryIID);