diff --git a/mozilla/htmlparser/src/nsHTMLTokens.cpp b/mozilla/htmlparser/src/nsHTMLTokens.cpp
index 9e4603a0e48..7f971ff0592 100644
--- a/mozilla/htmlparser/src/nsHTMLTokens.cpp
+++ b/mozilla/htmlparser/src/nsHTMLTokens.cpp
@@ -1032,62 +1032,83 @@ nsresult ConsumeStrictComment(nsScanner& aScanner, nsString& aString) {
   aScanner.EndReading(end);
   aScanner.CurrentPosition(current);
 
-  nsReadingIterator<PRUnichar> currentEnd = end, beginData = end;
-  PRBool balancedComment = PR_TRUE;
+  nsReadingIterator<PRUnichar> beginData = end;
 
-  static NS_NAMED_LITERAL_STRING(dashes,"--");
+  // Regular comment must start with <!--
+  if (current != end && *current == kMinus &&
+      ++current != end && *current == kMinus &&
+      ++current != end) {
+    nsReadingIterator<PRUnichar> currentEnd = end;
+    PRBool balancedComment = PR_FALSE;
+    static NS_NAMED_LITERAL_STRING(dashes,"--");
+    beginData = current;
 
-  while (FindInReadable(dashes, current, currentEnd)) {
-    current.advance(2);
-    if (beginData == end) {
-      beginData = current;
-    }
-    balancedComment = !balancedComment; // We need to match '--' with '--'
+    while (FindInReadable(dashes, current, currentEnd)) {
+      current.advance(2);
+
+      balancedComment = !balancedComment; // We need to match '--' with '--'
     
-    if (balancedComment && IsCommentEnd(current, end, gt)) {
-      // done
-      current.advance(-2);
-      if (beginData != current) { // protects from <!---->
+      if (balancedComment && IsCommentEnd(current, end, gt)) {
+        // done
+        current.advance(-2);
+        if (beginData != current) { // protects from <!---->
 #if 0
-        // XXX We should do this, but it HANGS until bug 112943 is fixed:
-        aString = Substring(beginData, current);
+          // XXX We should do this, but it HANGS until bug 112943 is fixed:
+          aString = Substring(beginData, current);
 #else
-        // XXX Instead we can do this EVIL HACK (from jag):
-        PRUint32 len = Distance(beginData, current);
-        aString.SetLength(len);
-        PRUnichar* dest = NS_CONST_CAST(PRUnichar*, aString.get());
-        copy_string(beginData, current, dest);
+          // XXX Instead we can do this EVIL HACK (from jag):
+          PRUint32 len = Distance(beginData, current);
+          aString.SetLength(len);
+          PRUnichar* dest = NS_CONST_CAST(PRUnichar*, aString.get());
+          copy_string(beginData, current, dest);
 #endif
+        }
+        aScanner.SetPosition(++gt);
+        return NS_OK;
+      } else {
+        // Continue after the last '--'
+        currentEnd = end;
       }
-      aScanner.SetPosition(++gt);
-      return NS_OK;
-    } else {
-      // Continue after the last '--'
-      currentEnd = end;
     }
   }
 
-  // This might have been empty comment: <!>
-  // Or it could have been something completely bogus like: <!This is foobar>
-  // Handle both cases below
-  aScanner.CurrentPosition(current);
-  beginData = current;
-  if (FindCharInReadable('>', current, end)) {
+  // If beginData == end, we did not find opening '--'
+  if (beginData == end) {
+    // This might have been empty comment: <!>
+    // Or it could have been something completely bogus like: <!This is foobar>
+    // Handle both cases below
+    aScanner.CurrentPosition(current);
+    beginData = current;
+    if (FindCharInReadable('>', current, end)) {
 #if 0
-    // XXX We should do this, but it HANGS until bug 112943 is fixed:
-    aString = Substring(beginData, current);
+      // XXX We should do this, but it HANGS until bug 112943 is fixed:
+      aString = Substring(beginData, current);
 #else
-    // XXX Instead we can do this EVIL HACK (from jag):
-    PRUint32 len = Distance(beginData, current);
-    aString.SetLength(len);
-    PRUnichar* dest = NS_CONST_CAST(PRUnichar*, aString.get());
-    copy_string(beginData, current, dest);
+      // XXX Instead we can do this EVIL HACK (from jag):
+      PRUint32 len = Distance(beginData, current);
+      aString.SetLength(len);
+      PRUnichar* dest = NS_CONST_CAST(PRUnichar*, aString.get());
+      copy_string(beginData, current, dest);
 #endif    
-    aScanner.SetPosition(++current);
-    return NS_OK;
+      aScanner.SetPosition(++current);
+      return NS_OK;
+    }
   }
-  
-  return kEOF; // not really an nsresult, but...
+
+  if (aScanner.IsIncremental()) {
+    // We got here because we saw the beginning of a comment,
+    // but not yet the end, and we are still loading the page. In that
+    // case the return value here will cause us to unwind,
+    // wait for more content, and try again.
+    // XXX For performance reasons we should cache where we were, and
+    //     continue from there for next call
+    return kEOF; // not really an nsresult, but...
+  }
+
+  // XXX We should return kNotAComment, parse comment open as text, and parse
+  //     the rest of the document normally. Now we ALMOST do that: <! is
+  //     missing from the content model.
+  return NS_OK;
 }
 
 static
@@ -1256,7 +1277,10 @@ nsresult CCommentToken::Consume(PRUnichar aChar, nsScanner& aScanner,PRInt32 aFl
     result=ConsumeComment(aScanner,mTextValue);
   }
 
-  mNewlineCount = !(aFlag & NS_IPARSER_FLAG_VIEW_SOURCE) ? mTextValue.CountChar(kNewLine) : -1;
+  if (NS_SUCCEEDED(result)) {
+    mNewlineCount = !(aFlag & NS_IPARSER_FLAG_VIEW_SOURCE) ? mTextValue.CountChar(kNewLine) : -1;
+  }
+
   return result;
 }
 
@@ -2163,12 +2187,12 @@ PRInt32 CEntityToken::TranslateToUnicodeStr(nsString& aString) {
       value=mTextValue.ToInteger(&err,kAutoDetect);
 
       if(0==err) {
-  #ifdef PA_REMAP_128_TO_160_ILLEGAL_NCR
+#ifdef PA_REMAP_128_TO_160_ILLEGAL_NCR
         /* for some illegal, but popular usage */
         if ((value >= 0x0080) && (value <= 0x009f)) {
           value = PA_HackTable[value - 0x0080];
         }
-  #endif
+#endif
         if (IS_IN_BMP(value))
           aString.Append(PRUnichar(value));
         else {
diff --git a/mozilla/parser/htmlparser/src/nsHTMLTokens.cpp b/mozilla/parser/htmlparser/src/nsHTMLTokens.cpp
index 9e4603a0e48..7f971ff0592 100644
--- a/mozilla/parser/htmlparser/src/nsHTMLTokens.cpp
+++ b/mozilla/parser/htmlparser/src/nsHTMLTokens.cpp
@@ -1032,62 +1032,83 @@ nsresult ConsumeStrictComment(nsScanner& aScanner, nsString& aString) {
   aScanner.EndReading(end);
   aScanner.CurrentPosition(current);
 
-  nsReadingIterator<PRUnichar> currentEnd = end, beginData = end;
-  PRBool balancedComment = PR_TRUE;
+  nsReadingIterator<PRUnichar> beginData = end;
 
-  static NS_NAMED_LITERAL_STRING(dashes,"--");
+  // Regular comment must start with <!--
+  if (current != end && *current == kMinus &&
+      ++current != end && *current == kMinus &&
+      ++current != end) {
+    nsReadingIterator<PRUnichar> currentEnd = end;
+    PRBool balancedComment = PR_FALSE;
+    static NS_NAMED_LITERAL_STRING(dashes,"--");
+    beginData = current;
 
-  while (FindInReadable(dashes, current, currentEnd)) {
-    current.advance(2);
-    if (beginData == end) {
-      beginData = current;
-    }
-    balancedComment = !balancedComment; // We need to match '--' with '--'
+    while (FindInReadable(dashes, current, currentEnd)) {
+      current.advance(2);
+
+      balancedComment = !balancedComment; // We need to match '--' with '--'
     
-    if (balancedComment && IsCommentEnd(current, end, gt)) {
-      // done
-      current.advance(-2);
-      if (beginData != current) { // protects from <!---->
+      if (balancedComment && IsCommentEnd(current, end, gt)) {
+        // done
+        current.advance(-2);
+        if (beginData != current) { // protects from <!---->
 #if 0
-        // XXX We should do this, but it HANGS until bug 112943 is fixed:
-        aString = Substring(beginData, current);
+          // XXX We should do this, but it HANGS until bug 112943 is fixed:
+          aString = Substring(beginData, current);
 #else
-        // XXX Instead we can do this EVIL HACK (from jag):
-        PRUint32 len = Distance(beginData, current);
-        aString.SetLength(len);
-        PRUnichar* dest = NS_CONST_CAST(PRUnichar*, aString.get());
-        copy_string(beginData, current, dest);
+          // XXX Instead we can do this EVIL HACK (from jag):
+          PRUint32 len = Distance(beginData, current);
+          aString.SetLength(len);
+          PRUnichar* dest = NS_CONST_CAST(PRUnichar*, aString.get());
+          copy_string(beginData, current, dest);
 #endif
+        }
+        aScanner.SetPosition(++gt);
+        return NS_OK;
+      } else {
+        // Continue after the last '--'
+        currentEnd = end;
       }
-      aScanner.SetPosition(++gt);
-      return NS_OK;
-    } else {
-      // Continue after the last '--'
-      currentEnd = end;
     }
   }
 
-  // This might have been empty comment: <!>
-  // Or it could have been something completely bogus like: <!This is foobar>
-  // Handle both cases below
-  aScanner.CurrentPosition(current);
-  beginData = current;
-  if (FindCharInReadable('>', current, end)) {
+  // If beginData == end, we did not find opening '--'
+  if (beginData == end) {
+    // This might have been empty comment: <!>
+    // Or it could have been something completely bogus like: <!This is foobar>
+    // Handle both cases below
+    aScanner.CurrentPosition(current);
+    beginData = current;
+    if (FindCharInReadable('>', current, end)) {
 #if 0
-    // XXX We should do this, but it HANGS until bug 112943 is fixed:
-    aString = Substring(beginData, current);
+      // XXX We should do this, but it HANGS until bug 112943 is fixed:
+      aString = Substring(beginData, current);
 #else
-    // XXX Instead we can do this EVIL HACK (from jag):
-    PRUint32 len = Distance(beginData, current);
-    aString.SetLength(len);
-    PRUnichar* dest = NS_CONST_CAST(PRUnichar*, aString.get());
-    copy_string(beginData, current, dest);
+      // XXX Instead we can do this EVIL HACK (from jag):
+      PRUint32 len = Distance(beginData, current);
+      aString.SetLength(len);
+      PRUnichar* dest = NS_CONST_CAST(PRUnichar*, aString.get());
+      copy_string(beginData, current, dest);
 #endif    
-    aScanner.SetPosition(++current);
-    return NS_OK;
+      aScanner.SetPosition(++current);
+      return NS_OK;
+    }
   }
-  
-  return kEOF; // not really an nsresult, but...
+
+  if (aScanner.IsIncremental()) {
+    // We got here because we saw the beginning of a comment,
+    // but not yet the end, and we are still loading the page. In that
+    // case the return value here will cause us to unwind,
+    // wait for more content, and try again.
+    // XXX For performance reasons we should cache where we were, and
+    //     continue from there for next call
+    return kEOF; // not really an nsresult, but...
+  }
+
+  // XXX We should return kNotAComment, parse comment open as text, and parse
+  //     the rest of the document normally. Now we ALMOST do that: <! is
+  //     missing from the content model.
+  return NS_OK;
 }
 
 static
@@ -1256,7 +1277,10 @@ nsresult CCommentToken::Consume(PRUnichar aChar, nsScanner& aScanner,PRInt32 aFl
     result=ConsumeComment(aScanner,mTextValue);
   }
 
-  mNewlineCount = !(aFlag & NS_IPARSER_FLAG_VIEW_SOURCE) ? mTextValue.CountChar(kNewLine) : -1;
+  if (NS_SUCCEEDED(result)) {
+    mNewlineCount = !(aFlag & NS_IPARSER_FLAG_VIEW_SOURCE) ? mTextValue.CountChar(kNewLine) : -1;
+  }
+
   return result;
 }
 
@@ -2163,12 +2187,12 @@ PRInt32 CEntityToken::TranslateToUnicodeStr(nsString& aString) {
       value=mTextValue.ToInteger(&err,kAutoDetect);
 
       if(0==err) {
-  #ifdef PA_REMAP_128_TO_160_ILLEGAL_NCR
+#ifdef PA_REMAP_128_TO_160_ILLEGAL_NCR
         /* for some illegal, but popular usage */
         if ((value >= 0x0080) && (value <= 0x009f)) {
           value = PA_HackTable[value - 0x0080];
         }
-  #endif
+#endif
         if (IS_IN_BMP(value))
           aString.Append(PRUnichar(value));
         else {