diff --git a/mozilla/content/html/document/crashtests/448564.html b/mozilla/content/html/document/crashtests/448564.html
new file mode 100644
index 00000000000..f31830afa13
--- /dev/null
+++ b/mozilla/content/html/document/crashtests/448564.html
@@ -0,0 +1,7 @@
+<s>
+<form>a</form>
+<iframe></iframe>
+<script src=a></script>
+<form></form>
+<table>
+<optgroup>
diff --git a/mozilla/content/html/document/reftests/bug448564-1_ideal.html b/mozilla/content/html/document/reftests/bug448564-1_ideal.html
new file mode 100644
index 00000000000..e93c1771f66
--- /dev/null
+++ b/mozilla/content/html/document/reftests/bug448564-1_ideal.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+  <link rel="stylesheet" type="text/css"
+        href="bug448564_forms.css">
+  </link>
+</head>
+<body>
+  <i><b>
+    <form>a</form>
+    <form>b</form>
+  </b></i>
+</body>
+</html>
diff --git a/mozilla/content/html/document/reftests/bug448564-1_malformed.html b/mozilla/content/html/document/reftests/bug448564-1_malformed.html
new file mode 100644
index 00000000000..404517c70e5
--- /dev/null
+++ b/mozilla/content/html/document/reftests/bug448564-1_malformed.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+  <link rel="stylesheet" type="text/css"
+        href="bug448564_forms.css">
+  </link>
+</head>
+<body>
+  <i><b>
+    <form>a</form> <!-- These forms should not end up nested! -->
+    <form>b</form>
+    <!-- Why does it matter whether we explicitly close this tag? -->
+    <!-- It matters because nsHTMLTokenizer::ScanDocStructure checks
+         whether there are any malformed tags before parsing begins,
+         and, if there are any, residual style tags (<i>, <b>, &c.)
+         must be pushed inside block elements (e.g., <form>). -->
+    <div><!-- </div> -->
+  </b></i>
+</body>
+</html>
diff --git a/mozilla/content/html/document/reftests/bug448564-1_well-formed.html b/mozilla/content/html/document/reftests/bug448564-1_well-formed.html
new file mode 100644
index 00000000000..46dbb8bdd08
--- /dev/null
+++ b/mozilla/content/html/document/reftests/bug448564-1_well-formed.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+  <link rel="stylesheet" type="text/css"
+        href="bug448564_forms.css">
+  </link>
+</head>
+<body>
+  <form><i><b>a</b></i></form>
+  <form><i><b>b</b></i></form>
+</body>
+</html>
diff --git a/mozilla/content/html/document/reftests/bug448564-2_malformed.html b/mozilla/content/html/document/reftests/bug448564-2_malformed.html
new file mode 100644
index 00000000000..ec676b5ae2a
--- /dev/null
+++ b/mozilla/content/html/document/reftests/bug448564-2_malformed.html
@@ -0,0 +1,11 @@
+<html>
+<body>
+  <s>
+  <form>a</form>
+  <iframe></iframe>
+  <script src=a></script>
+  <form></form>
+  <table>
+  <optgroup>
+</body>
+</html>
diff --git a/mozilla/content/html/document/reftests/bug448564-2_well-formed.html b/mozilla/content/html/document/reftests/bug448564-2_well-formed.html
new file mode 100644
index 00000000000..f7657e58d74
--- /dev/null
+++ b/mozilla/content/html/document/reftests/bug448564-2_well-formed.html
@@ -0,0 +1,14 @@
+<html>
+<body>
+  <s>
+    <form>a</form>
+    <iframe></iframe>
+  </s>
+  <form></form>
+  <form>
+    <select>
+      <optgroup></optgroup>
+    </select>
+  </form>
+</body>
+</html>
diff --git a/mozilla/content/html/document/reftests/bug448564-3_malformed.html b/mozilla/content/html/document/reftests/bug448564-3_malformed.html
new file mode 100644
index 00000000000..01a52a06202
--- /dev/null
+++ b/mozilla/content/html/document/reftests/bug448564-3_malformed.html
@@ -0,0 +1,4 @@
+<table>
+  <th>head</th>
+  <optgroup></optgroup>
+</table>
diff --git a/mozilla/content/html/document/reftests/bug448564-3_well-formed.html b/mozilla/content/html/document/reftests/bug448564-3_well-formed.html
new file mode 100644
index 00000000000..71f02c680ac
--- /dev/null
+++ b/mozilla/content/html/document/reftests/bug448564-3_well-formed.html
@@ -0,0 +1,8 @@
+<form>
+  <select>
+    <optgroup></optgroup>
+  </select>
+</form>
+<table>
+  <th>head</th>
+</table>
diff --git a/mozilla/content/html/document/reftests/bug448564-4a.html b/mozilla/content/html/document/reftests/bug448564-4a.html
new file mode 100644
index 00000000000..6fbaf85c2f2
--- /dev/null
+++ b/mozilla/content/html/document/reftests/bug448564-4a.html
@@ -0,0 +1,10 @@
+<html>
+<body>
+  <b><i>
+    <!-- Closing a form causes any open residual style tags to be closed
+         as well.  This test ensures that these tags get reopened. -->
+    <form>form contents</form>
+    bold text
+  </i></b>
+</body>
+</html>
diff --git a/mozilla/content/html/document/reftests/bug448564-4b.html b/mozilla/content/html/document/reftests/bug448564-4b.html
new file mode 100644
index 00000000000..f04d5fe48f7
--- /dev/null
+++ b/mozilla/content/html/document/reftests/bug448564-4b.html
@@ -0,0 +1,6 @@
+<html>
+<body>
+  <form><b><i>form contents</i></b></form>
+  <b><i>bold text</i></b>
+</body>
+</html>
diff --git a/mozilla/content/html/document/reftests/bug448564-5_malformed.html b/mozilla/content/html/document/reftests/bug448564-5_malformed.html
new file mode 100644
index 00000000000..2a9391d76a3
--- /dev/null
+++ b/mozilla/content/html/document/reftests/bug448564-5_malformed.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+  <link rel="stylesheet" type="text/css"
+        href="bug448564_forms.css">
+  </link>
+</head>
+<body>
+  <form>
+    <table>
+      <optgroup></optgroup>
+    </table>
+    <input type="button" value="button"></input>
+  </form>
+  <b>asdf</b>
+</body>
+</html>
diff --git a/mozilla/content/html/document/reftests/bug448564-5_well-formed.html b/mozilla/content/html/document/reftests/bug448564-5_well-formed.html
new file mode 100644
index 00000000000..bdf65c1fd79
--- /dev/null
+++ b/mozilla/content/html/document/reftests/bug448564-5_well-formed.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+  <link rel="stylesheet" type="text/css"
+        href="bug448564_forms.css">
+  </link>
+</head>
+<body>
+  <form>
+    <select>
+      <optgroup></optgroup>
+    </select>
+    <table></table>
+    <input type="button" value="button"></input>
+  </form>
+  <b>asdf</b>
+</body>
+</html>
diff --git a/mozilla/content/html/document/reftests/bug448564_forms.css b/mozilla/content/html/document/reftests/bug448564_forms.css
new file mode 100644
index 00000000000..b98788862c1
--- /dev/null
+++ b/mozilla/content/html/document/reftests/bug448564_forms.css
@@ -0,0 +1,2 @@
+/* make nesting obvious */
+form { border: 1px solid black; }
diff --git a/mozilla/content/html/document/reftests/reftests.list b/mozilla/content/html/document/reftests/reftests.list
new file mode 100644
index 00000000000..3578976906e
--- /dev/null
+++ b/mozilla/content/html/document/reftests/reftests.list
@@ -0,0 +1,10 @@
+== bug448564-1_malformed.html bug448564-1_well-formed.html
+== bug448564-1_malformed.html bug448564-1_ideal.html
+
+== bug448564-2_malformed.html bug448564-2_well-formed.html
+
+== bug448564-3_malformed.html bug448564-3_well-formed.html
+
+== bug448564-4a.html          bug448564-4b.html
+
+== bug448564-5_malformed.html bug448564-5_well-formed.html
diff --git a/mozilla/content/html/document/test/bug448564-echo.sjs b/mozilla/content/html/document/test/bug448564-echo.sjs
new file mode 100644
index 00000000000..0b6eea9d9dd
--- /dev/null
+++ b/mozilla/content/html/document/test/bug448564-echo.sjs
@@ -0,0 +1,8 @@
+function handleRequest(request, response) {
+  response.setHeader("Cache-Control", "no-cache", false);
+  response.setStatusLine(request.httpVersion, 200, "OK");
+  
+  response.write("<script>");
+  response.write("  parent.checkQueryString('" + request.queryString + "');");
+  response.write("</script>");
+}
diff --git a/mozilla/content/html/document/test/bug448564-iframe-1.html b/mozilla/content/html/document/test/bug448564-iframe-1.html
new file mode 100644
index 00000000000..4f3e79e5d27
--- /dev/null
+++ b/mozilla/content/html/document/test/bug448564-iframe-1.html
@@ -0,0 +1,16 @@
+<html>
+<body>
+
+  <table>
+    <form action="bug448564-echo.sjs" method="GET">
+      <tr><td><input name="a" value="aval"></td></tr>
+      <input type="hidden" name="b" value="bval">
+      <input name="c" value="cval">
+      <tr><td><input name="d" value="dval" type="submit"></td></tr>
+    </form>
+  </table>
+
+  <script src="bug448564-submit.js"></script>
+
+</body>
+</html>
diff --git a/mozilla/content/html/document/test/bug448564-iframe-2.html b/mozilla/content/html/document/test/bug448564-iframe-2.html
new file mode 100644
index 00000000000..dba19b37e2d
--- /dev/null
+++ b/mozilla/content/html/document/test/bug448564-iframe-2.html
@@ -0,0 +1,16 @@
+<html>
+<body>
+
+  <form action="bug448564-echo.sjs" method="GET">
+    <table>
+      <tr><td><input name="a" value="aval"></td></tr>
+      <input type="hidden" name="b" value="bval">
+      <input name="c" value="cval">
+      <tr><td><input name="d" value="dval" type="submit"></td></tr>
+    </table>
+  </form>
+
+  <script src="bug448564-submit.js"></script>
+
+</body>
+</html>
diff --git a/mozilla/content/html/document/test/bug448564-iframe-3.html b/mozilla/content/html/document/test/bug448564-iframe-3.html
new file mode 100644
index 00000000000..64288ebb15d
--- /dev/null
+++ b/mozilla/content/html/document/test/bug448564-iframe-3.html
@@ -0,0 +1,16 @@
+<html>
+<body>
+
+  <table>
+    <span><form action="bug448564-echo.sjs" method="GET">
+      <tr><td><input name="a" value="aval"></td></tr>
+      <input type="hidden" name="b" value="bval">
+      <input name="c" value="cval">
+      <tr><td><input name="d" value="dval" type="submit"></td></tr>
+    </form></span>
+  </table>
+
+  <script src="bug448564-submit.js"></script>
+
+</body>
+</html>
diff --git a/mozilla/content/html/document/test/bug448564-submit.js b/mozilla/content/html/document/test/bug448564-submit.js
new file mode 100644
index 00000000000..34de44d4dd5
--- /dev/null
+++ b/mozilla/content/html/document/test/bug448564-submit.js
@@ -0,0 +1,4 @@
+var inputs = document.getElementsByTagName("input");
+for (var input, i = 0; input = inputs[i]; ++i)
+  if ("submit" == input.type)
+    input.click();
diff --git a/mozilla/content/html/document/test/test_bug448564.html b/mozilla/content/html/document/test/test_bug448564.html
new file mode 100644
index 00000000000..f565178ca9b
--- /dev/null
+++ b/mozilla/content/html/document/test/test_bug448564.html
@@ -0,0 +1,63 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=448564
+-->
+<head>
+  <title>Test for Bug 448564</title>
+  <script type="text/javascript" src="/MochiKit/MochiKit.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+  
+  <script type="text/javascript;version=1.8">
+    var toCheck = [];
+
+    function flush() {
+      if (!check)
+        return;
+
+      for each (let qs in toCheck)
+        check(qs);
+
+      toCheck.length = 0;
+    }
+
+    function checkQueryString(queryString) {
+      toCheck.push(queryString);
+      flush();
+    }
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=448564">Mozilla Bug 448564</a>
+<p id="display">
+  <iframe src="bug448564-iframe-1.html"></iframe>
+  <iframe src="bug448564-iframe-2.html"></iframe>
+  <iframe src="bug448564-iframe-3.html"></iframe>
+</p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+/** Test for Bug 448564 **/
+
+var checksToDo = document.getElementsByTagName("iframe").length;
+
+function check(queryString) {
+  is(queryString.split("&").sort().join("&"),
+     "a=aval&b=bval&c=cval&d=dval",
+     "Not all form fields were properly submitted.");
+  if (--checksToDo == 0)
+    SimpleTest.finish();
+}
+
+flush();
+
+SimpleTest.waitForExplicitFinish();
+
+</script>
+</pre>
+</body>
+</html>
