diff --git a/mozilla/parser/htmlparser/src/CNavDTD.cpp b/mozilla/parser/htmlparser/src/CNavDTD.cpp
index f3c9809a1b2..83999966068 100644
--- a/mozilla/parser/htmlparser/src/CNavDTD.cpp
+++ b/mozilla/parser/htmlparser/src/CNavDTD.cpp
@@ -1382,7 +1382,7 @@ static void PushMisplacedAttributes(nsIParserNode& aNode,nsDeque& aDeque,PRInt32
     nsCParserNode* theAttrNode = (nsCParserNode*)&aNode;
     if(theAttrNode) {
       while(aCount){ 
-        theAttrToken=theAttrNode->PopAttributeToken();
+        theAttrToken=theAttrNode->PopAttributeTokenFront();
         if(theAttrToken) {
           theAttrToken->SetNewlineCount(0);
           aDeque.Push(theAttrToken);
@@ -2013,14 +2013,21 @@ nsresult CNavDTD::HandleSavedTokens(PRInt32 anIndex) {
           if(theToken) {
             theTag       = (eHTMLTags)theToken->GetTypeID();
             attrCount    = (gHTMLElements[theTag].mSkipTarget)? 0:theToken->GetAttributeCount();
+            // Put back attributes, which once got popped out, into the
+            // tokenizer.  Make sure we preserve their ordering, however!
+            // XXXbz would it be faster to get the tokens out with ObjectAt and
+            // put them in the tokenizer and then PopFront them all from
+            // mMisplacedContent?
+            nsDeque temp;
             // Put back attributes, which once got popped out, into the tokenizer
             for(PRInt32 j=0;j<attrCount; ++j){
               CToken* theAttrToken = (CToken*)mMisplacedContent.PopFront();
               if(theAttrToken) {
-                mTokenizer->PushTokenFront(theAttrToken);
+                temp.Push(theAttrToken);
               }
               theBadTokenCount--;
             }
+            mTokenizer->PrependTokens(temp);
             
             if(eToken_end==theToken->GetTokenType()) {
               // Ref: Bug 25202
diff --git a/mozilla/parser/htmlparser/src/nsParserNode.cpp b/mozilla/parser/htmlparser/src/nsParserNode.cpp
index cb7f02a9485..b4d190cc0bc 100644
--- a/mozilla/parser/htmlparser/src/nsParserNode.cpp
+++ b/mozilla/parser/htmlparser/src/nsParserNode.cpp
@@ -264,6 +264,11 @@ nsCParserNode::PopAttributeToken() {
   return 0;
 }
 
+CToken* 
+nsCParserNode::PopAttributeTokenFront() {
+  return 0;
+}
+
 /** Retrieve a string containing the tag and its attributes in "source" form
  * @update	rickg 06June2000
  * @return  void
@@ -353,6 +358,12 @@ nsCParserStartNode::PopAttributeToken()
   return NS_STATIC_CAST(CToken*, mAttributes.Pop());
 }
 
+CToken* 
+nsCParserStartNode::PopAttributeTokenFront() 
+{
+  return NS_STATIC_CAST(CToken*, mAttributes.PopFront());
+}
+
 void nsCParserStartNode::GetSource(nsString& aString) 
 {
   aString.Assign(PRUnichar('<'));
diff --git a/mozilla/parser/htmlparser/src/nsParserNode.h b/mozilla/parser/htmlparser/src/nsParserNode.h
index 1f942f480c9..99c5abb6c0c 100644
--- a/mozilla/parser/htmlparser/src/nsParserNode.h
+++ b/mozilla/parser/htmlparser/src/nsParserNode.h
@@ -238,6 +238,9 @@ class nsCParserNode :  public nsIParserNode {
      */
     virtual CToken* PopAttributeToken();
 
+    /** Like PopAttributeToken, but pops off the front of the attribute list */
+    virtual CToken* PopAttributeTokenFront();
+
     /** Retrieve a string containing the tag and its attributes in "source" form
      * @update	rickg 06June2000
      * @return  void
@@ -312,6 +315,7 @@ public:
     virtual const    nsAString& GetKeyAt(PRUint32 anIndex) const;
     virtual const    nsAString& GetValueAt(PRUint32 anIndex) const;
     virtual CToken*  PopAttributeToken();
+    virtual CToken*  PopAttributeTokenFront();
     virtual void     GetSource(nsString& aString);
     virtual nsresult ReleaseAll();
 protected: