diff --git a/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp b/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp
index c0dbfba9ad0..2d684153ebf 100644
--- a/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp
+++ b/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp
@@ -650,7 +650,6 @@ ChromeListener :: ChromeListener ( nsWebBrowser* inBrowser, nsIWebBrowserChrome*
 //
 ChromeListener :: ~ChromeListener ( )
 {
-  RemoveChromeListeners();
   
 } // dtor
 
@@ -760,17 +759,14 @@ ChromeListener :: AddTooltipListener()
 NS_IMETHODIMP
 ChromeListener :: RemoveChromeListeners ( )
 {
+  HideTooltip();
+
   if ( mContextMenuListenerInstalled )
     RemoveContextMenuListener();
     
   if ( mTooltipListenerInstalled )
     RemoveTooltipListener();
   
-  // because of a bug in the EventListenerManager with listeners registered to multiple
-  // IID's, we might not have release all refs when removing the listeners. Clearing
-  // our ref to the listener will free them, but use a deathgrip to make sure we don't
-  // go away until we're truly ready.
-  nsCOMPtr<nsIDOMMouseListener> kungFuDeathGrip ( this );
   mEventReceiver = nsnull;
   
   // it really doesn't matter if these fail...
@@ -789,9 +785,6 @@ NS_IMETHODIMP
 ChromeListener :: RemoveContextMenuListener()
 {
   if (mEventReceiver) {
-    // Removing the mouse listener may cause this instance to
-    // be deleted...  So, keep an extra reference to defer destruction..
-    nsCOMPtr<nsIDOMMouseListener> kungFuDeathGrip(this);
     nsIDOMMouseListener *pListener = NS_STATIC_CAST(nsIDOMMouseListener *, this);
     nsresult rv = mEventReceiver->RemoveEventListenerByIID(pListener, NS_GET_IID(nsIDOMMouseListener));
     if (NS_SUCCEEDED(rv))
@@ -811,9 +804,6 @@ NS_IMETHODIMP
 ChromeListener :: RemoveTooltipListener()
 {
   if (mEventReceiver) {
-    // Removing the mouse listener may cause this instance to
-    // be deleted...  So, keep an extra reference to defer destruction..
-    nsCOMPtr<nsIDOMMouseListener> kungFuDeathGrip(this);
     nsIDOMMouseListener *pListener = NS_STATIC_CAST(nsIDOMMouseListener *, this);
     nsresult rv = mEventReceiver->RemoveEventListenerByIID(pListener, NS_GET_IID(nsIDOMMouseListener));
     nsresult rv2 = mEventReceiver->RemoveEventListenerByIID(pListener, NS_GET_IID(nsIDOMMouseMotionListener));
diff --git a/embedding/browser/webBrowser/nsDocShellTreeOwner.h b/embedding/browser/webBrowser/nsDocShellTreeOwner.h
index 239274864a4..1275b9e927d 100644
--- a/embedding/browser/webBrowser/nsDocShellTreeOwner.h
+++ b/embedding/browser/webBrowser/nsDocShellTreeOwner.h
@@ -167,8 +167,13 @@ private:
   NS_IMETHOD RemoveTooltipListener();
 
   nsWebBrowser* mWebBrowser;
-  nsIWebBrowserChrome* mWebBrowserChrome;
   nsCOMPtr<nsIDOMEventReceiver> mEventReceiver;
+  
+    // This must be a strong ref in order to make sure we can hide the tooltip
+    // if the window goes away while we're displaying one. If we don't hold
+    // a strong ref, the chrome might have been disposed of before we get a chance
+    // to tell it, and no one would ever tell us of that fact.
+  nsCOMPtr<nsIWebBrowserChrome> mWebBrowserChrome;
 
   PRPackedBool mContextMenuListenerInstalled;
   PRPackedBool mTooltipListenerInstalled;