diff --git a/mozilla/layout/base/nsCSSFrameConstructor.cpp b/mozilla/layout/base/nsCSSFrameConstructor.cpp
index e86f6f74853..e90d38eca6b 100644
--- a/mozilla/layout/base/nsCSSFrameConstructor.cpp
+++ b/mozilla/layout/base/nsCSSFrameConstructor.cpp
@@ -2160,15 +2160,22 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIFrame*             aParentFram
           return NS_ERROR_OUT_OF_MEMORY;
 
         counterList->Insert(node);
-        if (counterList->IsLast(node))
-          node->Calc(counterList);
-        else {
-          counterList->SetDirty();
-          CountersDirty();
+        PRBool dirty = counterList->IsDirty();
+        if (!dirty) {
+          if (counterList->IsLast(node)) {
+            node->Calc(counterList);
+            node->GetText(contentString);
+          }
+          // In all other cases (list already dirty or node not at the end),
+          // just start with an empty string for now and when we recalculate
+          // the list we'll change the value to the right one.
+          else {
+            counterList->SetDirty();
+            CountersDirty();
+          }
         }
 
         textPtr = &node->mText; // text node assigned below
-        node->GetText(contentString);
       }
       break;
 
diff --git a/mozilla/layout/base/nsCounterManager.cpp b/mozilla/layout/base/nsCounterManager.cpp
index 27187372226..ebdbc02a8c2 100644
--- a/mozilla/layout/base/nsCounterManager.cpp
+++ b/mozilla/layout/base/nsCounterManager.cpp
@@ -44,6 +44,8 @@
 // Should be called immediately after calling |Insert|.
 void nsCounterUseNode::Calc(nsCounterList *aList)
 {
+    NS_ASSERTION(!aList->IsDirty(),
+                 "Why are we calculating with a dirty list?");
     mValueAfter = aList->ValueBefore(this);
 }
 
@@ -51,6 +53,8 @@ void nsCounterUseNode::Calc(nsCounterList *aList)
 // Should be called immediately after calling |Insert|.
 void nsCounterChangeNode::Calc(nsCounterList *aList)
 {
+    NS_ASSERTION(!aList->IsDirty(),
+                 "Why are we calculating with a dirty list?");
     if (mType == RESET) {
         mValueAfter = mChangeValue;
     } else {
@@ -233,7 +237,12 @@ nsCounterManager::AddResetOrIncrement(nsIFrame *aFrame, PRInt32 aIndex,
         // list.
         return PR_TRUE;
     }
-    node->Calc(counterList);
+
+    // Don't call Calc() if the list is already dirty -- it'll be recalculated
+    // anyway, and trying to calculate with a dirty list doesn't work.
+    if (NS_LIKELY(!counterList->IsDirty())) {
+        node->Calc(counterList);
+    }
     return PR_FALSE;
 }
 
diff --git a/mozilla/layout/base/nsCounterManager.h b/mozilla/layout/base/nsCounterManager.h
index a62bf3571b8..6e52c5e27bd 100644
--- a/mozilla/layout/base/nsCounterManager.h
+++ b/mozilla/layout/base/nsCounterManager.h
@@ -187,7 +187,11 @@ public:
 
     void Insert(nsCounterNode* aNode) {
         nsGenConList::Insert(aNode);
-        SetScope(aNode);
+        // Don't SetScope if we're dirty -- we'll reset all the scopes anyway,
+        // and we can't usefully compute scopes right now.
+        if (NS_LIKELY(!IsDirty())) {
+            SetScope(aNode);
+        }
     }
 
     nsCounterNode* First() {