diff --git a/mozilla/extensions/xforms/nsXFormsModelElement.cpp b/mozilla/extensions/xforms/nsXFormsModelElement.cpp
index 4229d6b4e83..fb00941158e 100644
--- a/mozilla/extensions/xforms/nsXFormsModelElement.cpp
+++ b/mozilla/extensions/xforms/nsXFormsModelElement.cpp
@@ -249,7 +249,7 @@ nsXFormsControlListItem::iterator::operator*()
 
 nsXFormsControlListItem::nsXFormsControlListItem(
   nsIXFormsControl* aControl,
-  nsDataHashtable<nsISupportsHashKey,nsXFormsControlListItem *>* aHashtable)
+  nsRefPtrHashtable<nsISupportsHashKey,nsXFormsControlListItem>* aHashtable)
   : mNode(aControl),
     mNextSibling(nsnull),
     mFirstChild(nsnull),
@@ -288,14 +288,12 @@ nsXFormsControlListItem::Clear()
     mFirstChild->Clear();
     NS_ASSERTION(!(mFirstChild->mFirstChild || mFirstChild->mNextSibling),
                  "child did not clear members!!");
-    delete mFirstChild;
     mFirstChild = nsnull;
   }
   if (mNextSibling) {
     mNextSibling->Clear();
     NS_ASSERTION(!(mNextSibling->mFirstChild || mNextSibling->mNextSibling),
                  "sibling did not clear members!!");
-    delete mNextSibling;
     mNextSibling = nsnull;
   }
   if (mNode) {
@@ -322,10 +320,9 @@ nsXFormsControlListItem::AddControl(nsIXFormsControl *aControl,
 
   // 2) control with no parent
   if (!aParent) {
-    nsXFormsControlListItem* newNode =
+    nsRefPtr<nsXFormsControlListItem> newNode =
       new nsXFormsControlListItem(aControl, mControlListHash);
-
-    NS_ENSURE_STATE(newNode);
+    NS_ENSURE_TRUE(newNode, NS_ERROR_OUT_OF_MEMORY);
 
     // Empty tree (we have already checked mFirstChild)
     if (!mNode) {
@@ -365,10 +362,10 @@ nsXFormsControlListItem::AddControl(nsIXFormsControl *aControl,
   }
 
   // 4) first child for parentControl
-  nsXFormsControlListItem* newNode =
+  nsRefPtr<nsXFormsControlListItem> newNode =
     new nsXFormsControlListItem(aControl, mControlListHash);
+  NS_ENSURE_TRUE(newNode, NS_ERROR_OUT_OF_MEMORY);
 
-  NS_ENSURE_STATE(newNode);
   parentControl->mFirstChild = newNode;
   nsCOMPtr<nsIDOMElement> ele;
   aControl->GetElement(getter_AddRefs(ele));
@@ -458,7 +455,6 @@ nsXFormsControlListItem::RemoveControl(nsIXFormsControl *aControl,
     nsCOMPtr<nsIDOMElement> element;
     deleteMe->mNode->GetElement(getter_AddRefs(element));
     mControlListHash->Remove(element);
-    delete deleteMe;
     aRemoved = PR_TRUE;
   }
 
@@ -1193,9 +1189,9 @@ nsXFormsModelElement::RefreshSubTree(nsXFormsControlListItem *aCurrent,
                                      PRBool                   aForceRebind)
 {
   nsresult rv;
-
-  while (aCurrent) {
-    nsCOMPtr<nsIXFormsControl> control(aCurrent->Control());
+  nsRefPtr<nsXFormsControlListItem> current = aCurrent;
+  while (current) {
+    nsCOMPtr<nsIXFormsControl> control(current->Control());
     NS_ASSERTION(control, "A tree node without a control?!");
     
     // Get bound node
@@ -1232,7 +1228,7 @@ nsXFormsModelElement::RefreshSubTree(nsXFormsControlListItem *aCurrent,
         if (!boundNode) {
           // If a control uses a model binding, but has no bound node a
           // rebuild is the only thing that'll (eventually) change it
-          aCurrent = aCurrent->NextSibling();
+          current = current->NextSibling();
           continue;
         }
       } else {
@@ -1325,10 +1321,10 @@ nsXFormsModelElement::RefreshSubTree(nsXFormsControlListItem *aCurrent,
     }
 
     // Refresh children
-    rv = RefreshSubTree(aCurrent->FirstChild(), rebindChildren);
+    rv = RefreshSubTree(current->FirstChild(), rebindChildren);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    aCurrent = aCurrent->NextSibling();
+    current = current->NextSibling();
   }
 
   return NS_OK;
diff --git a/mozilla/extensions/xforms/nsXFormsModelElement.h b/mozilla/extensions/xforms/nsXFormsModelElement.h
index 3af99bd5674..6f0e644c9d5 100644
--- a/mozilla/extensions/xforms/nsXFormsModelElement.h
+++ b/mozilla/extensions/xforms/nsXFormsModelElement.h
@@ -58,6 +58,7 @@
 #include "nsISchema.h"
 #include "nsIXFormsContextControl.h"
 #include "nsDataHashtable.h"
+#include "nsRefPtrHashtable.h"
 
 class nsIDOMElement;
 class nsIDOMNode;
@@ -128,16 +129,18 @@ protected:
  */
 class nsXFormsControlListItem
 {
+  nsAutoRefCnt                      mRefCnt;
+
   /** The XForms control itself */
-  nsCOMPtr<nsIXFormsControl>      mNode;
+  nsCOMPtr<nsIXFormsControl>        mNode;
 
   /** The next sibling of the node */
-  nsXFormsControlListItem        *mNextSibling;
+  nsRefPtr<nsXFormsControlListItem> mNextSibling;
 
   /** The first child of the node */
-  nsXFormsControlListItem        *mFirstChild;
+  nsRefPtr<nsXFormsControlListItem> mFirstChild;
 
-  nsDataHashtable<nsISupportsHashKey,nsXFormsControlListItem *> *mControlListHash;
+  nsRefPtrHashtable<nsISupportsHashKey, nsXFormsControlListItem> *mControlListHash;
 
 public:
 
@@ -148,11 +151,31 @@ public:
    */
   nsXFormsControlListItem(
     nsIXFormsControl* aControl,
-    nsDataHashtable<nsISupportsHashKey,nsXFormsControlListItem *> *aHash);
+    nsRefPtrHashtable<nsISupportsHashKey,nsXFormsControlListItem> *aHash);
   nsXFormsControlListItem();
   ~nsXFormsControlListItem();
   nsXFormsControlListItem(const nsXFormsControlListItem& aCopy);
 
+  nsrefcnt AddRef()
+  {
+    ++mRefCnt;
+    NS_LOG_ADDREF(this, mRefCnt, "nsXFormsControlListItem",
+                  sizeof(nsXFormsControlListItem));
+    return mRefCnt;
+  }
+
+  nsrefcnt Release()
+  {
+    --mRefCnt;
+    NS_LOG_RELEASE(this, mRefCnt, "nsXFormsControlListItem");
+    if (mRefCnt == 0) {
+      mRefCnt = 1;
+      delete this;
+      return 0;
+    }
+    return mRefCnt;
+  }
+
   /** Clear contents of current node, all siblings, and all children */
   void Clear();
 
@@ -443,7 +466,7 @@ private:
   nsCOMPtr<nsISchemaLoader> mSchemas;
   nsStringArray             mPendingInlineSchemas;
   nsXFormsControlListItem   mFormControls;
-  nsDataHashtable<nsISupportsHashKey,nsXFormsControlListItem *> mControlListHash;
+  nsRefPtrHashtable<nsISupportsHashKey, nsXFormsControlListItem> mControlListHash;
 
   PRInt32 mSchemaCount;
   PRInt32 mSchemaTotal;