diff --git a/mozilla/layout/generic/nsFrame.cpp b/mozilla/layout/generic/nsFrame.cpp
index b39b63c8ab0..30ef95ff9ac 100644
--- a/mozilla/layout/generic/nsFrame.cpp
+++ b/mozilla/layout/generic/nsFrame.cpp
@@ -1326,6 +1326,34 @@ nsFrame::Invalidate(const nsRect& aDamageRect,
   NS_IF_RELEASE(viewManager);
 }
 
+#define MAX_REFLOW_DEPTH 500
+
+PRBool
+nsFrame::IsFrameTreeTooDeep(const nsHTMLReflowState& aReflowState,
+                            nsHTMLReflowMetrics& aMetrics)
+{
+  if (aReflowState.mReflowDepth > MAX_REFLOW_DEPTH) {
+    mState |= NS_FRAME_IS_UNFLOWABLE;
+    mState &= ~NS_FRAME_OUTSIDE_CHILDREN;
+    aMetrics.width = 0;
+    aMetrics.height = 0;
+    aMetrics.ascent = 0;
+    aMetrics.descent = 0;
+    aMetrics.mCarriedOutBottomMargin = 0;
+    aMetrics.mCombinedArea.x = 0;
+    aMetrics.mCombinedArea.y = 0;
+    aMetrics.mCombinedArea.width = 0;
+    aMetrics.mCombinedArea.height = 0;
+    if (aMetrics.maxElementSize) {
+      aMetrics.maxElementSize->width = 0;
+      aMetrics.maxElementSize->height = 0;
+    }
+    return PR_TRUE;
+  }
+  mState &= ~NS_FRAME_IS_UNFLOWABLE;
+  return PR_FALSE;
+}
+
 // Style sizing methods
 NS_IMETHODIMP nsFrame::IsPercentageBase(PRBool& aBase) const
 {
diff --git a/mozilla/layout/generic/nsFrame.h b/mozilla/layout/generic/nsFrame.h
index a4260670b34..312b2fcc371 100644
--- a/mozilla/layout/generic/nsFrame.h
+++ b/mozilla/layout/generic/nsFrame.h
@@ -302,6 +302,14 @@ public:
                                     nsStyleChangeList* aChangeList,
                                     PRInt32* aLocalChange);
 
+  // Helper function that tests if the frame tree is too deep; if it
+  // is it marks the frame as "unflowable" and zeros out the metrics
+  // and returns PR_TRUE. Otherwise, the frame is unmarked
+  // "unflowable" and the metrics are not touched and PR_FALSE is
+  // returned.
+  PRBool IsFrameTreeTooDeep(const nsHTMLReflowState& aReflowState,
+                            nsHTMLReflowMetrics& aMetrics);
+
 #ifdef NS_DEBUG
   /**
    * Tracing method that writes a method enter/exit routine to the
diff --git a/mozilla/layout/html/base/src/nsFrame.cpp b/mozilla/layout/html/base/src/nsFrame.cpp
index b39b63c8ab0..30ef95ff9ac 100644
--- a/mozilla/layout/html/base/src/nsFrame.cpp
+++ b/mozilla/layout/html/base/src/nsFrame.cpp
@@ -1326,6 +1326,34 @@ nsFrame::Invalidate(const nsRect& aDamageRect,
   NS_IF_RELEASE(viewManager);
 }
 
+#define MAX_REFLOW_DEPTH 500
+
+PRBool
+nsFrame::IsFrameTreeTooDeep(const nsHTMLReflowState& aReflowState,
+                            nsHTMLReflowMetrics& aMetrics)
+{
+  if (aReflowState.mReflowDepth > MAX_REFLOW_DEPTH) {
+    mState |= NS_FRAME_IS_UNFLOWABLE;
+    mState &= ~NS_FRAME_OUTSIDE_CHILDREN;
+    aMetrics.width = 0;
+    aMetrics.height = 0;
+    aMetrics.ascent = 0;
+    aMetrics.descent = 0;
+    aMetrics.mCarriedOutBottomMargin = 0;
+    aMetrics.mCombinedArea.x = 0;
+    aMetrics.mCombinedArea.y = 0;
+    aMetrics.mCombinedArea.width = 0;
+    aMetrics.mCombinedArea.height = 0;
+    if (aMetrics.maxElementSize) {
+      aMetrics.maxElementSize->width = 0;
+      aMetrics.maxElementSize->height = 0;
+    }
+    return PR_TRUE;
+  }
+  mState &= ~NS_FRAME_IS_UNFLOWABLE;
+  return PR_FALSE;
+}
+
 // Style sizing methods
 NS_IMETHODIMP nsFrame::IsPercentageBase(PRBool& aBase) const
 {
diff --git a/mozilla/layout/html/base/src/nsFrame.h b/mozilla/layout/html/base/src/nsFrame.h
index a4260670b34..312b2fcc371 100644
--- a/mozilla/layout/html/base/src/nsFrame.h
+++ b/mozilla/layout/html/base/src/nsFrame.h
@@ -302,6 +302,14 @@ public:
                                     nsStyleChangeList* aChangeList,
                                     PRInt32* aLocalChange);
 
+  // Helper function that tests if the frame tree is too deep; if it
+  // is it marks the frame as "unflowable" and zeros out the metrics
+  // and returns PR_TRUE. Otherwise, the frame is unmarked
+  // "unflowable" and the metrics are not touched and PR_FALSE is
+  // returned.
+  PRBool IsFrameTreeTooDeep(const nsHTMLReflowState& aReflowState,
+                            nsHTMLReflowMetrics& aMetrics);
+
 #ifdef NS_DEBUG
   /**
    * Tracing method that writes a method enter/exit routine to the