Fix for bug 5850:

1) Add a RemoveChild() method to nsIWebshell.
2) nsWebshell::Destroy() calls this method on its parent to remove itself from the parent's child list.
3) Call nsWebshell::Destroy() from nsHTMLFrameInnerFrame's detructor.

webshell/public/nsIWebShell.h

@@ -262,6 +262,11 @@ public:
    */
   NS_IMETHOD AddChild(nsIWebShell* aChild) = 0;
 
+  /**
+   * Remove a child WebShell.
+   */
+  NS_IMETHOD RemoveChild(nsIWebShell* aChild) = 0;
+
   /**
    * Return the child WebShell at the requested index.
    */