diff --git a/mozilla/content/base/public/nsIContent.h b/mozilla/content/base/public/nsIContent.h
index e5c4237995f..8a104f0bc80 100644
--- a/mozilla/content/base/public/nsIContent.h
+++ b/mozilla/content/base/public/nsIContent.h
@@ -309,6 +309,34 @@ public:
 
   NS_IMETHOD GetListenerManager(nsIEventListenerManager** aResult) = 0;
 
+  /**
+   * This method is called when the parser finishes creating the element.  This
+   * particularly means that it has done everything you would expect it to have
+   * done after it encounters the > at the end of the tag (for HTML or XML).
+   * This includes setting the attributes, setting the document / form, and
+   * placing the element into the tree at its proper place.
+   *
+   * For container elements, this is called *before* any of the children are
+   * created or added into the tree.
+   *
+   * NOTE: this is currently only called for input and button, in the HTML
+   * content sink.  If you want to call it on your element, modify the content
+   * sink of your choice to do so.  This is an efficiency measure.
+   *
+   * If you also need to determine whether the parser is the one creating your
+   * element (through createElement() or cloneNode() generally)   * aFromParser to the NS_NewXXX() constructor for your element and have the
+   * parser pass true.  See nsHTMLInputElement.cpp and
+   * nsHTMLContentSink::MakeContentObject().
+   *
+   * DO NOT USE THIS METHOD to get around the fact that it's hard to deal with
+   * attributes dynamically.  If you make attributes affect your element from
+   * this method, it will only happen on initialization and JavaScript will not
+   * be able to create elements (which requires them to first create the
+   * element and then call setAttribute() directly, at which point
+   * DoneCreatingElement() has already been called and is out of the picture).
+   */
+  NS_IMETHOD DoneCreatingElement() = 0;
+
 #ifdef DEBUG
   /**
    * Get the size of the content object. The size value should include
diff --git a/mozilla/content/base/src/nsGenericDOMDataNode.cpp b/mozilla/content/base/src/nsGenericDOMDataNode.cpp
index b9c7b2dbc78..47f9b826040 100644
--- a/mozilla/content/base/src/nsGenericDOMDataNode.cpp
+++ b/mozilla/content/base/src/nsGenericDOMDataNode.cpp
@@ -641,6 +641,11 @@ nsGenericDOMDataNode::GetListenerManager(nsIEventListenerManager** aResult)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsGenericDOMDataNode::DoneCreatingElement()
+{
+  return NS_OK;
+}
 //----------------------------------------------------------------------
 
 // Implementation of nsIContent
diff --git a/mozilla/content/base/src/nsGenericDOMDataNode.h b/mozilla/content/base/src/nsGenericDOMDataNode.h
index 1823798ff2f..409ff3d4429 100644
--- a/mozilla/content/base/src/nsGenericDOMDataNode.h
+++ b/mozilla/content/base/src/nsGenericDOMDataNode.h
@@ -210,6 +210,7 @@ public:
   NS_IMETHOD_(PRBool) IsContentOfType(PRUint32 aFlags);
 
   NS_IMETHOD GetListenerManager(nsIEventListenerManager** aInstancePtrResult);
+  NS_IMETHOD DoneCreatingElement();
 
 #ifdef DEBUG
   NS_IMETHOD SizeOf(nsISizeOfHandler* aSizer, PRUint32* aResult) const;
diff --git a/mozilla/content/base/src/nsGenericElement.cpp b/mozilla/content/base/src/nsGenericElement.cpp
index 14f9e2fb871..89d652f6549 100644
--- a/mozilla/content/base/src/nsGenericElement.cpp
+++ b/mozilla/content/base/src/nsGenericElement.cpp
@@ -2040,6 +2040,12 @@ nsGenericElement::GetListenerManager(nsIEventListenerManager** aResult)
   return rv;
 }
 
+NS_IMETHODIMP
+nsGenericElement::DoneCreatingElement()
+{
+  return NS_OK;
+}
+
 //----------------------------------------------------------------------
 
 // Generic DOMNode implementations
diff --git a/mozilla/content/base/src/nsGenericElement.h b/mozilla/content/base/src/nsGenericElement.h
index bd65b4ef6e6..e5b9a3b83ab 100644
--- a/mozilla/content/base/src/nsGenericElement.h
+++ b/mozilla/content/base/src/nsGenericElement.h
@@ -251,6 +251,7 @@ public:
   NS_IMETHOD SetBindingParent(nsIContent* aParent);
   NS_IMETHOD_(PRBool) IsContentOfType(PRUint32 aFlags);
   NS_IMETHOD GetListenerManager(nsIEventListenerManager** aInstancePtrResult);
+  NS_IMETHOD DoneCreatingElement();
 
 
   // nsIStyledContent interface methods
diff --git a/mozilla/content/html/content/public/MANIFEST_IDL b/mozilla/content/html/content/public/MANIFEST_IDL
index 8c2f1675be1..45f83a30314 100644
--- a/mozilla/content/html/content/public/MANIFEST_IDL
+++ b/mozilla/content/html/content/public/MANIFEST_IDL
@@ -3,3 +3,4 @@
 #
 
 nsISelectElement.idl
+nsITextAreaElement.idl
diff --git a/mozilla/content/html/content/public/Makefile.in b/mozilla/content/html/content/public/Makefile.in
index 095b3219dff..6d33674c0d1 100644
--- a/mozilla/content/html/content/public/Makefile.in
+++ b/mozilla/content/html/content/public/Makefile.in
@@ -31,6 +31,7 @@ XPIDL_MODULE    = content_html
 
 XPIDLSRCS	= \
 		nsISelectElement.idl \
+		nsITextAreaElement.idl \
 		$(NULL)
 
 EXPORTS		= \
diff --git a/mozilla/content/html/content/public/makefile.win b/mozilla/content/html/content/public/makefile.win
index f8b3dc35fe8..289d7de8209 100644
--- a/mozilla/content/html/content/public/makefile.win
+++ b/mozilla/content/html/content/public/makefile.win
@@ -23,6 +23,7 @@ DEPTH=..\..\..\..
 
 XPIDLSRCS = \
 	.\nsISelectElement.idl \
+	.\nsITextAreaElement.idl \
 	$(NULL)
 
 EXPORTS= \
diff --git a/mozilla/content/html/content/public/nsIFormControl.h b/mozilla/content/html/content/public/nsIFormControl.h
index c12270eaa6d..c201fa37171 100644
--- a/mozilla/content/html/content/public/nsIFormControl.h
+++ b/mozilla/content/html/content/public/nsIFormControl.h
@@ -131,14 +131,13 @@ public:
   /**
    * Save to presentation state
    */
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext,
-                       nsIPresState** aState) = 0;
+  NS_IMETHOD SaveState() = 0;
 
   /**
    * Restore from presentation state
+   * @param aState the pres state to use to restore the control
    */
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext,
-                          nsIPresState* aState) = 0;
+  NS_IMETHOD RestoreState(nsIPresState* aState) = 0;
 };
 
 #endif /* nsIFormControl_h___ */
diff --git a/mozilla/content/html/content/public/nsISelectElement.idl b/mozilla/content/html/content/public/nsISelectElement.idl
index b8a8dcd97e1..ffce7df44b3 100644
--- a/mozilla/content/html/content/public/nsISelectElement.idl
+++ b/mozilla/content/html/content/public/nsISelectElement.idl
@@ -83,16 +83,18 @@ interface nsISelectElement : nsISupports
   [noscript] void removeOption(in nsIContent aContent);
 
   /**
-   * Indicates that we're done adding child content
+   * Called when the parser is done adding child content
    * to the select during document loading.
    */
-  void doneAddingContent(in boolean aIsDone);
+  void doneAddingChildren();
 
   /**
-   * Returns whether we're done adding child content
+   * Returns whether the parser is done adding child content
    * to the select during document loading.
+   *
+   * @return whether the parser is done adding children
    */
-  boolean isDoneAddingContent();
+  boolean isDoneAddingChildren();
 
   /**
    * Returns whether we're the option is selected
@@ -128,8 +130,6 @@ interface nsISelectElement : nsISupports
   /**
    * Called to save/restore to/from pres. state
    */
-  [noscript] void saveState(in nsIPresContext aPresContext,
-                            out nsIPresState aState);
-  [noscript] void restoreState(in nsIPresContext aPresContext,
-                               in nsIPresState aState);
+  [noscript] void saveState();
+  [noscript] void restoreState(in nsIPresState aState);
 };
diff --git a/mozilla/content/html/content/public/nsITextAreaElement.idl b/mozilla/content/html/content/public/nsITextAreaElement.idl
new file mode 100644
index 00000000000..29a4bd89936
--- /dev/null
+++ b/mozilla/content/html/content/public/nsITextAreaElement.idl
@@ -0,0 +1,54 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: NPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Netscape Public License
+ * Version 1.1 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/NPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the NPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the NPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "nsISupports.idl"
+
+/**
+ * This interface is used so that the parser can notify the textarea when
+ * it has finished loading content.
+ */
+
+[scriptable, uuid(36878df2-1dd2-11b2-99a0-ea9fab347485)]
+interface nsITextAreaElement : nsISupports
+{
+  /**
+   * Called when the parser is done adding child content
+   * to the select during document loading.
+   */
+  void doneAddingChildren();
+};
diff --git a/mozilla/content/html/content/src/nsAttributeContent.cpp b/mozilla/content/html/content/src/nsAttributeContent.cpp
index 316ff8a39f4..109c0ee8cf8 100644
--- a/mozilla/content/html/content/src/nsAttributeContent.cpp
+++ b/mozilla/content/html/content/src/nsAttributeContent.cpp
@@ -139,6 +139,10 @@ public:
     return NS_ERROR_NOT_IMPLEMENTED;
   }
 
+  NS_IMETHOD DoneCreatingElement() {
+    return NS_OK;
+  }
+
   NS_IMETHOD SetAttr(PRInt32 aNameSpaceID, nsIAtom* aAttribute, const nsAString& aValue,
                      PRBool aNotify) {  return NS_OK; }
   NS_IMETHOD SetAttr(nsINodeInfo *aNodeInfo, const nsAString& aValue,
diff --git a/mozilla/content/html/content/src/nsGenericHTMLElement.cpp b/mozilla/content/html/content/src/nsGenericHTMLElement.cpp
index eef97415d80..05f6ed48178 100644
--- a/mozilla/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/mozilla/content/html/content/src/nsGenericHTMLElement.cpp
@@ -2951,44 +2951,98 @@ nsGenericHTMLElement::GetPrimaryPresState(nsIHTMLContent* aContent,
 
   nsresult result = NS_OK;
 
-  // Generate the state key
+  nsCOMPtr<nsILayoutHistoryState> history;
+  nsCAutoString key;
+  GetLayoutHistoryAndKey(aContent, getter_AddRefs(history), key);
+
+  if (history) {
+    // Get the pres state for this key, if it doesn't exist, create one
+    result = history->GetState(key, aPresState);
+    if (!*aPresState) {
+      result = nsComponentManager::CreateInstance(kPresStateCID, nsnull,
+                                                  NS_GET_IID(nsIPresState),
+                                                  (void**)aPresState);
+      if (NS_SUCCEEDED(result)) {
+        result = history->AddState(key, *aPresState);
+      }
+    }
+  }
+
+  return result;
+}
+
+
+nsresult
+nsGenericHTMLElement::GetLayoutHistoryAndKey(nsIHTMLContent* aContent,
+                                             nsILayoutHistoryState** aHistory,
+                                             nsACString& aKey)
+{
+  //
+  // Get the pres shell
+  //
   nsCOMPtr<nsIDocument> doc;
-  result = aContent->GetDocument(*getter_AddRefs(doc));
+  nsresult rv = aContent->GetDocument(*getter_AddRefs(doc));
   if (!doc) {
-    return result;
+    return rv;
   }
 
   nsCOMPtr<nsIPresShell> presShell;
   doc->GetShellAt(0, getter_AddRefs(presShell));
   NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
 
+  //
+  // Get the history (don't bother with the key if the history is not there)
+  //
+  rv = presShell->GetHistoryState(aHistory);
+  NS_ENSURE_SUCCESS(rv, rv);
+  if (!*aHistory) {
+    return NS_OK;
+  }
+
+  //
+  // Get the state key
+  //
   nsCOMPtr<nsIFrameManager> frameManager;
   presShell->GetFrameManager(getter_AddRefs(frameManager));
   NS_ENSURE_TRUE(frameManager, NS_ERROR_FAILURE);
 
-  nsCAutoString stateKey;
-  result = frameManager->GenerateStateKey(aContent, nsIStatefulFrame::eNoID, stateKey);
-  NS_ENSURE_TRUE((NS_SUCCEEDED(result) && !stateKey.IsEmpty()), result);
+  rv = frameManager->GenerateStateKey(aContent, nsIStatefulFrame::eNoID, aKey);
+  NS_ENSURE_SUCCESS(rv, rv);
 
-  // Get the pres state for this key, if it doesn't exist, create one
-  //
-  // Return early if we can't get history - we don't want to create a
-  // new history state that is free-floating, not in history.
-  nsCOMPtr<nsILayoutHistoryState> history;
-  result = presShell->GetHistoryState(getter_AddRefs(history));
-  NS_ENSURE_TRUE(NS_SUCCEEDED(result) && history, result);
-
-  history->GetState(stateKey, aPresState);
-  if (!*aPresState) {
-    result = nsComponentManager::CreateInstance(kPresStateCID, nsnull,
-                                                NS_GET_IID(nsIPresState),
-                                                (void**)aPresState);
-    if (NS_SUCCEEDED(result)) {
-      result = history->AddState(stateKey, *aPresState);
-    }
+  // If the state key is blank, this is anonymous content or for
+  // whatever reason we are not supposed to save/restore state.
+  if (aKey.IsEmpty()) {
+    NS_RELEASE(*aHistory);
+    return NS_OK;
   }
 
-  return result;
+  // Add something unique to content so layout doesn't muck us up
+  aKey += "-C";
+
+  return rv;
+}
+
+PRBool
+nsGenericHTMLElement::RestoreFormControlState(nsIHTMLContent* aContent,
+                                              nsIFormControl* aControl)
+{
+  nsCOMPtr<nsILayoutHistoryState> history;
+  nsCAutoString key;
+  nsresult rv = GetLayoutHistoryAndKey(aContent, getter_AddRefs(history), key);
+  if (!history) {
+    return PR_FALSE;
+  }
+
+  nsCOMPtr<nsIPresState> state;
+  // Get the pres state for this key
+  rv = history->GetState(key, getter_AddRefs(state));
+  if (state) {
+    rv = aControl->RestoreState(state);
+    history->RemoveState(key);
+    return NS_SUCCEEDED(rv);
+  }
+
+  return PR_FALSE;
 }
 
 // XXX This creates a dependency between content and frames
@@ -4200,6 +4254,11 @@ nsGenericHTMLContainerFormElement::SetDocument(nsIDocument* aDocument,
 {
   nsresult rv = NS_OK;
 
+  // Save state before doing anything if the document is being removed
+  if (!aDocument) {
+    SaveState();
+  }
+
   if (aDocument && mParent && !mForm) {
     rv = FindAndSetForm(this);
   } else if (!aDocument && mForm) {
@@ -4226,6 +4285,7 @@ nsGenericHTMLContainerFormElement::SetDocument(nsIDocument* aDocument,
   return rv;
 }
 
+
 nsresult
 nsGenericHTMLElement::SetFormControlAttribute(nsIForm* aForm,
                                               PRInt32 aNameSpaceID,
@@ -4444,6 +4504,11 @@ nsGenericHTMLLeafFormElement::SetDocument(nsIDocument* aDocument,
 {
   nsresult rv = NS_OK;
 
+  // Save state before doing anything if the document is being removed
+  if (!aDocument) {
+    SaveState();
+  }
+
   if (aDocument && mParent && !mForm) {
     rv = FindAndSetForm(this);
   } else if (!aDocument && mForm) {
@@ -4470,6 +4535,13 @@ nsGenericHTMLLeafFormElement::SetDocument(nsIDocument* aDocument,
   return rv;
 }
 
+NS_IMETHODIMP
+nsGenericHTMLLeafFormElement::DoneCreatingElement()
+{
+  RestoreFormControlState(this, this);
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsGenericHTMLLeafFormElement::SetAttr(PRInt32 aNameSpaceID,
                                       nsIAtom* aName,
diff --git a/mozilla/content/html/content/src/nsGenericHTMLElement.h b/mozilla/content/html/content/src/nsGenericHTMLElement.h
index ba70ef0e87f..f9bd9042635 100644
--- a/mozilla/content/html/content/src/nsGenericHTMLElement.h
+++ b/mozilla/content/html/content/src/nsGenericHTMLElement.h
@@ -53,7 +53,6 @@
 class nsIDOMAttr;
 class nsIDOMEventListener;
 class nsIDOMNodeList;
-class nsIEventListenerManager;
 class nsIFrame;
 class nsHTMLAttributes;
 class nsIHTMLMappedAttributes;
@@ -68,6 +67,7 @@ class nsIFormControlFrame;
 class nsIForm;
 class nsIPresState;
 class nsIScrollableView;
+class nsILayoutHistoryState;
 struct nsRect;
 
 
@@ -357,8 +357,38 @@ public:
   static nsIFormControlFrame* GetFormControlFrameFor(nsIContent* aContent,
                                                      nsIDocument* aDocument,
                                                      PRBool aFlushContent);
+  /**
+   * Get the presentation state for a piece of content, or create it if it does
+   * not exist.  Generally used by SaveState().
+   *
+   * @param aContent the content to get presentation state for.
+   * @param aPresState the presentation state (out param)
+   */
   static nsresult GetPrimaryPresState(nsIHTMLContent* aContent,
                                       nsIPresState** aPresState);
+  /**
+   * Get the layout history object *and* generate the key for a particular
+   * piece of content.
+   *
+   * @param aContent the content to generate the key for
+   * @param aState the history state object (out param)
+   * @param aKey the key (out param)
+   */
+  static nsresult GetLayoutHistoryAndKey(nsIHTMLContent* aContent,
+                                         nsILayoutHistoryState** aState,
+                                         nsACString& aKey);
+  /**
+   * Restore the state for a form control.  Ends up calling
+   * nsIFormControl::RestoreState().
+   *
+   * @param aContent an nsIHTMLContent* pointing to the form control
+   * @param aControl an nsIFormControl* pointing to the form control
+   * @return whether or not the RestoreState() was called and exited
+   *         successfully.
+   */
+  static PRBool RestoreFormControlState(nsIHTMLContent* aContent,
+                                        nsIFormControl* aControl);
+
   static nsresult GetPresContext(nsIHTMLContent* aContent,
                                  nsIPresContext** aPresContext);
 
@@ -589,14 +619,8 @@ public:
   NS_IMETHOD GetForm(nsIDOMHTMLFormElement** aForm);
   NS_IMETHOD SetForm(nsIDOMHTMLFormElement* aForm,
                      PRBool aRemoveFromForm = PR_TRUE);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState)
-  {
-    return NS_OK;
-  }
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
-  {
-    return NS_OK;
-  }
+  NS_IMETHOD SaveState() { return NS_OK; }
+  NS_IMETHOD RestoreState(nsIPresState* aState) { return NS_OK; }
 
   // nsIContent
   NS_IMETHOD SetParent(nsIContent *aParent);
@@ -638,14 +662,8 @@ public:
   NS_IMETHOD GetForm(nsIDOMHTMLFormElement** aForm);
   NS_IMETHOD SetForm(nsIDOMHTMLFormElement* aForm,
                      PRBool aRemoveFromForm = PR_TRUE);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState)
-  {
-    return NS_OK;
-  }
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
-  {
-    return NS_OK;
-  }
+  NS_IMETHOD SaveState() { return NS_OK; }
+  NS_IMETHOD RestoreState(nsIPresState* aState) { return NS_OK; }
 
   // nsIContent
   NS_IMETHOD SetParent(nsIContent *aParent);
@@ -658,7 +676,7 @@ public:
   NS_IMETHOD SetAttr(nsINodeInfo* aNodeInfo,
                      const nsAString& aValue,
                      PRBool aNotify);
-
+  NS_IMETHOD DoneCreatingElement();
 
   NS_METHOD SetAttribute(const nsAString& aName,
                          const nsAString& aValue)
@@ -949,7 +967,8 @@ nsresult
 NS_NewHTMLImageElement(nsIHTMLContent** aResult, nsINodeInfo *aNodeInfo);
 
 nsresult
-NS_NewHTMLInputElement(nsIHTMLContent** aResult, nsINodeInfo *aNodeInfo);
+NS_NewHTMLInputElement(nsIHTMLContent** aResult, nsINodeInfo *aNodeInfo,
+                       PRBool aFromParser);
 
 nsresult
 NS_NewHTMLInsElement(nsIHTMLContent** aResult, nsINodeInfo *aNodeInfo);
@@ -1015,7 +1034,8 @@ nsresult
 NS_NewHTMLScriptElement(nsIHTMLContent** aResult, nsINodeInfo *aNodeInfo);
 
 nsresult
-NS_NewHTMLSelectElement(nsIHTMLContent** aResult, nsINodeInfo *aNodeInfo);
+NS_NewHTMLSelectElement(nsIHTMLContent** aResult, nsINodeInfo *aNodeInfo,
+                        PRBool aFromParser);
 
 inline nsresult
 NS_NewHTMLSpacerElement(nsIHTMLContent** aResult, nsINodeInfo *aNodeInfo)
diff --git a/mozilla/content/html/content/src/nsHTMLInputElement.cpp b/mozilla/content/html/content/src/nsHTMLInputElement.cpp
index bb30e5eb5d5..5cb3fe7e15d 100644
--- a/mozilla/content/html/content/src/nsHTMLInputElement.cpp
+++ b/mozilla/content/html/content/src/nsHTMLInputElement.cpp
@@ -1,4 +1,3 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: NPL 1.1/GPL 2.0/LGPL 2.1
  *
@@ -119,6 +118,8 @@ typedef nsIGfxTextControlFrame2 textControlPlace;
 #define BF_CHECKED_CHANGED 3
 #define BF_CHECKED 4
 #define BF_HANDLING_SELECT_EVENT 5
+#define BF_SHOULD_INIT_CHECKED 6
+#define BF_PARSER_CREATING 7
 
 #define GET_BOOLBIT(bitfield, field) (((bitfield) & (0x01 << (field))) \
                                         ? PR_TRUE : PR_FALSE)
@@ -133,7 +134,7 @@ class nsHTMLInputElement : public nsGenericHTMLLeafFormElement,
                            public nsIRadioControlElement
 {
 public:
-  nsHTMLInputElement();
+  nsHTMLInputElement(PRBool aFromParser);
   virtual ~nsHTMLInputElement();
 
   // nsISupports
@@ -161,8 +162,8 @@ public:
   NS_IMETHOD Reset();
   NS_IMETHOD SubmitNamesValues(nsIFormSubmission* aFormSubmission,
                                nsIContent* aSubmitElement);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
+  NS_IMETHOD SaveState();
+  NS_IMETHOD RestoreState(nsIPresState* aState);
 
   // nsIContent
   NS_IMETHOD SetFocus(nsIPresContext* aPresContext);
@@ -212,6 +213,8 @@ public:
     return rv;
   }
 
+  NS_IMETHOD DoneCreatingElement();
+
   // nsITextControlElement
   NS_IMETHOD SetValueGuaranteed(const nsAString& aValue, nsIGfxTextControlFrame2* aFrame);
   NS_IMETHOD SetValueChanged(PRBool aValueChanged);
@@ -226,7 +229,6 @@ public:
 
 protected:
   // Helper method
-  void SetPresStateChecked(nsIHTMLContent * aHTMLContent, PRBool aValue);
   NS_IMETHOD SetValueSecure(const nsAString& aValue,
                             nsIGfxTextControlFrame2* aFrame,
                             PRBool aCheckSecurity);
@@ -310,11 +312,12 @@ NS_METHOD NS_GetRadioGetCheckedChangedVisitor(PRBool* aCheckedChanged,
 
 nsresult
 NS_NewHTMLInputElement(nsIHTMLContent** aInstancePtrResult,
-                       nsINodeInfo *aNodeInfo)
+                       nsINodeInfo *aNodeInfo,
+                       PRBool aFromParser)
 {
   NS_ENSURE_ARG_POINTER(aInstancePtrResult);
 
-  nsHTMLInputElement* it = new nsHTMLInputElement();
+  nsHTMLInputElement* it = new nsHTMLInputElement(aFromParser);
 
   if (!it) {
     return NS_ERROR_OUT_OF_MEMORY;
@@ -335,10 +338,11 @@ NS_NewHTMLInputElement(nsIHTMLContent** aInstancePtrResult,
 }
 
 
-nsHTMLInputElement::nsHTMLInputElement()
+nsHTMLInputElement::nsHTMLInputElement(PRBool aFromParser)
 {
   mType = NS_FORM_INPUT_TEXT; // default value
   mBitField = 0;
+  SET_BOOLBIT(mBitField, BF_PARSER_CREATING, aFromParser);
   mValue = nsnull;
 }
 
@@ -378,7 +382,7 @@ nsHTMLInputElement::CloneNode(PRBool aDeep, nsIDOMNode** aReturn)
   NS_ENSURE_ARG_POINTER(aReturn);
   *aReturn = nsnull;
 
-  nsHTMLInputElement* it = new nsHTMLInputElement();
+  nsHTMLInputElement* it = new nsHTMLInputElement(PR_FALSE);
 
   if (!it) {
     return NS_ERROR_OUT_OF_MEMORY;
@@ -452,10 +456,16 @@ nsHTMLInputElement::AfterSetAttr(PRInt32 aNameSpaceID, nsIAtom* aName,
   //
   if (aName == nsHTMLAtoms::checked &&
       !GET_BOOLBIT(mBitField, BF_CHECKED_CHANGED)) {
-    PRBool resetVal;
-    GetDefaultChecked(&resetVal);
-    SetChecked(resetVal);
-    SetCheckedChanged(PR_FALSE);
+    // Delay setting checked if the parser is creating this element (wait until
+    // everything is set)
+    if (GET_BOOLBIT(mBitField, BF_PARSER_CREATING)) {
+      SET_BOOLBIT(mBitField, BF_SHOULD_INIT_CHECKED, PR_TRUE);
+    } else {
+      PRBool defaultChecked;
+      GetDefaultChecked(&defaultChecked);
+      SetChecked(defaultChecked);
+      SetCheckedChanged(PR_FALSE);
+    }
   }
 }
 
@@ -616,6 +626,7 @@ nsHTMLInputElement::SetValueSecure(const nsAString& aValue,
   GetType(&type);
   if (NS_FORM_INPUT_TEXT == type || NS_FORM_INPUT_PASSWORD == type ||
       NS_FORM_INPUT_FILE == type) {
+
     if (aCheckSecurity && NS_FORM_INPUT_FILE == type) {
       nsresult rv;
       nsCOMPtr<nsIScriptSecurityManager> securityManager = 
@@ -637,7 +648,6 @@ nsHTMLInputElement::SetValueSecure(const nsAString& aValue,
       }
     }
 
-
     nsIGfxTextControlFrame2* textControlFrame = aFrame;
     nsIFormControlFrame* formControlFrame = textControlFrame;
     if (!textControlFrame) {
@@ -651,7 +661,12 @@ nsHTMLInputElement::SetValueSecure(const nsAString& aValue,
       }
     }
 
+    // File frames always own the value (if the frame is there).
+    // Text frames have a bit that says whether they own the value.
     PRBool frameOwnsValue = PR_FALSE;
+    if (type == NS_FORM_INPUT_FILE && formControlFrame) {
+      frameOwnsValue = PR_TRUE;
+    }
     if (textControlFrame) {
       textControlFrame->OwnsValue(&frameOwnsValue);
     }
@@ -699,20 +714,6 @@ nsHTMLInputElement::GetChecked(PRBool* aChecked)
   return NS_OK;
 }
 
-void
-nsHTMLInputElement::SetPresStateChecked(nsIHTMLContent * aHTMLContent, 
-                                        PRBool aValue)
-{
-  nsCOMPtr<nsIPresState> presState;
-  GetPrimaryPresState(aHTMLContent, getter_AddRefs(presState));
-
-  // Obtain the value property from the presentation state.
-  if (presState) {
-    nsAutoString value; value.AssignWithConversion( aValue ? "1" : "0" );
-    presState->SetStateProperty(NS_LITERAL_STRING("checked"), value);
-  }
-}
-
 NS_IMETHODIMP
 nsHTMLInputElement::SetCheckedChanged(PRBool aCheckedChanged)
 {
@@ -1597,8 +1598,9 @@ nsHTMLInputElement::StringToAttribute(nsIAtom* aAttribute,
       if (valueStr.EqualsIgnoreCase(table->tag)) {
         // If the type is being changed to file, set the element value
         // to the empty string. This is for security.
-        if (table->value == NS_FORM_INPUT_FILE)
+        if (table->value == NS_FORM_INPUT_FILE) {
           SetValue(NS_LITERAL_STRING(""));
+        }
         aResult.SetIntValue(table->value, eHTMLUnit_Enumerated);
         mType = table->value;  // set the type of this input
         return NS_CONTENT_ATTR_HAS_VALUE;
@@ -2009,7 +2011,7 @@ nsHTMLInputElement::Reset()
     case NS_FORM_INPUT_FILE:
     {
       // Resetting it to blank should not perform security check
-      rv = SetValueSecure(NS_LITERAL_STRING(""), nsnull, PR_FALSE);
+      rv = SetValueGuaranteed(NS_LITERAL_STRING(""), nsnull);
       break;
     }
     default:
@@ -2234,30 +2236,37 @@ nsHTMLInputElement::SubmitNamesValues(nsIFormSubmission* aFormSubmission,
 
 
 NS_IMETHODIMP
-nsHTMLInputElement::SaveState(nsIPresContext* aPresContext,
-                              nsIPresState** aState)
+nsHTMLInputElement::SaveState()
 {
   nsresult rv = NS_OK;
 
   PRInt32 type;
   GetType(&type);
   
+  nsCOMPtr<nsIPresState> state;
   switch (type) {
     case NS_FORM_INPUT_CHECKBOX:
     case NS_FORM_INPUT_RADIO:
       {
         PRBool checked = PR_FALSE;
         GetChecked(&checked);
-        rv = GetPrimaryPresState(this, aState);
-        if (*aState) {
-          if (checked) {
-            rv = (*aState)->SetStateProperty(NS_LITERAL_STRING("checked"),
-                                             NS_LITERAL_STRING("t"));
-          } else {
-            rv = (*aState)->SetStateProperty(NS_LITERAL_STRING("checked"),
-                                             NS_LITERAL_STRING("f"));
+        PRBool defaultChecked = PR_FALSE;
+        GetDefaultChecked(&defaultChecked);
+        // Only save if checked != defaultChecked (bug 62713)
+        // (always save if it's a radio button so that the checked
+        // state of all radio buttons is restored)
+        if (type == NS_FORM_INPUT_RADIO || checked != defaultChecked) {
+          rv = GetPrimaryPresState(this, getter_AddRefs(state));
+          if (state) {
+            if (checked) {
+              rv = state->SetStateProperty(NS_LITERAL_STRING("checked"),
+                                           NS_LITERAL_STRING("t"));
+            } else {
+              rv = state->SetStateProperty(NS_LITERAL_STRING("checked"),
+                                           NS_LITERAL_STRING("f"));
+            }
+            NS_ASSERTION(NS_SUCCEEDED(rv), "checked save failed!");
           }
-          NS_ASSERTION(NS_SUCCEEDED(rv), "checked save failed!");
         }
         break;
       }
@@ -2268,19 +2277,19 @@ nsHTMLInputElement::SaveState(nsIPresContext* aPresContext,
     case NS_FORM_INPUT_TEXT:
     case NS_FORM_INPUT_FILE:
       {
-        nsresult rv = GetPrimaryPresState(this, aState);
-        if (*aState) {
-          nsString value;
-          GetValue(value);
-          // XXX Should use nsAutoString above but ConvertStringLineBreaks
-          // requires mOwnsBuffer!
-          rv = nsLinebreakConverter::ConvertStringLineBreaks(
-                   value,
-                   nsLinebreakConverter::eLinebreakPlatform,
-                   nsLinebreakConverter::eLinebreakContent);
-          NS_ASSERTION(NS_SUCCEEDED(rv), "Converting linebreaks failed!");
-          rv = (*aState)->SetStateProperty(NS_LITERAL_STRING("value"), value);
-          NS_ASSERTION(NS_SUCCEEDED(rv), "value save failed!");
+        if (GET_BOOLBIT(mBitField, BF_VALUE_CHANGED)) {
+          rv = GetPrimaryPresState(this, getter_AddRefs(state));
+          if (state) {
+            nsAutoString value;
+            GetValue(value);
+            rv = nsLinebreakConverter::ConvertStringLineBreaks(
+                     value,
+                     nsLinebreakConverter::eLinebreakPlatform,
+                     nsLinebreakConverter::eLinebreakContent);
+            NS_ASSERTION(NS_SUCCEEDED(rv), "Converting linebreaks failed!");
+            rv = state->SetStateProperty(NS_LITERAL_STRING("v"), value);
+            NS_ASSERTION(NS_SUCCEEDED(rv), "value save failed!");
+          }
         }
         break;
       }
@@ -2290,8 +2299,41 @@ nsHTMLInputElement::SaveState(nsIPresContext* aPresContext,
 }
 
 NS_IMETHODIMP
-nsHTMLInputElement::RestoreState(nsIPresContext* aPresContext,
-                                 nsIPresState* aState)
+nsHTMLInputElement::DoneCreatingElement()
+{
+  SET_BOOLBIT(mBitField, BF_PARSER_CREATING, PR_FALSE);
+
+  //
+  // Restore state for checkbox, radio, text and file
+  //
+  PRBool restored = PR_FALSE;
+  switch (mType) {
+    case NS_FORM_INPUT_CHECKBOX:
+    case NS_FORM_INPUT_RADIO:
+    case NS_FORM_INPUT_TEXT:
+    case NS_FORM_INPUT_FILE:
+      restored = RestoreFormControlState(this, this);
+      break;
+  }
+
+  //
+  // If restore does not occur, we initialize .checked using the CHECKED
+  // property.
+  //
+  if (!restored && GET_BOOLBIT(mBitField, BF_SHOULD_INIT_CHECKED)) {
+    PRBool resetVal;
+    GetDefaultChecked(&resetVal);
+    SetChecked(resetVal);
+    SetCheckedChanged(PR_FALSE);
+  }
+
+  SET_BOOLBIT(mBitField, BF_SHOULD_INIT_CHECKED, PR_FALSE);
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsHTMLInputElement::RestoreState(nsIPresState* aState)
 {
   nsresult rv = NS_OK;
 
@@ -2306,25 +2348,18 @@ nsHTMLInputElement::RestoreState(nsIPresContext* aPresContext,
         rv = aState->GetStateProperty(NS_LITERAL_STRING("checked"), checked);
         // We assume that we are the only ones who saved the state.  Thus we
         // know the exact value that would have been saved.
-        if (checked.Equals(NS_LITERAL_STRING("t"))) {
-          SetChecked(PR_TRUE);
-        } else {
-          SetChecked(PR_FALSE);
-        }
+        SetChecked(checked.Equals(NS_LITERAL_STRING("t")));
 
         break;
       }
 
-    // Never save passwords in session history
-    case NS_FORM_INPUT_PASSWORD:
-      break;
     case NS_FORM_INPUT_TEXT:
     case NS_FORM_INPUT_FILE:
       {
         nsAutoString value;
-        rv = aState->GetStateProperty(NS_LITERAL_STRING("value"), value);
+        rv = aState->GetStateProperty(NS_LITERAL_STRING("v"), value);
         NS_ASSERTION(NS_SUCCEEDED(rv), "value restore failed!");
-        SetValue(value);
+        SetValueGuaranteed(value, nsnull);
         break;
       }
   }
diff --git a/mozilla/content/html/content/src/nsHTMLSelectElement.cpp b/mozilla/content/html/content/src/nsHTMLSelectElement.cpp
index c9b693160a5..f83497a64cd 100644
--- a/mozilla/content/html/content/src/nsHTMLSelectElement.cpp
+++ b/mozilla/content/html/content/src/nsHTMLSelectElement.cpp
@@ -128,7 +128,7 @@ class nsHTMLSelectElement : public nsGenericHTMLContainerFormElement,
                             public nsISelectElement
 {
 public:
-  nsHTMLSelectElement();
+  nsHTMLSelectElement(PRBool aFromParser);
   virtual ~nsHTMLSelectElement();
 
   // nsISupports
@@ -238,7 +238,7 @@ protected:
   nsISelectControlFrame *GetSelectFrame();
 
   nsHTMLOptionCollection* mOptions;
-  PRBool    mIsDoneAddingContent;
+  PRBool    mIsDoneAddingChildren;
   PRUint32  mArtifactsAtTopLevel;
   PRInt32   mSelectedIndex;
   nsString* mRestoreState;
@@ -254,11 +254,12 @@ protected:
 
 nsresult
 NS_NewHTMLSelectElement(nsIHTMLContent** aInstancePtrResult,
-                        nsINodeInfo *aNodeInfo)
+                        nsINodeInfo *aNodeInfo,
+                        PRBool aFromParser)
 {
   NS_ENSURE_ARG_POINTER(aInstancePtrResult);
 
-  nsHTMLSelectElement* it = new nsHTMLSelectElement();
+  nsHTMLSelectElement* it = new nsHTMLSelectElement(aFromParser);
 
   if (!it) {
     return NS_ERROR_OUT_OF_MEMORY;
@@ -279,9 +280,11 @@ NS_NewHTMLSelectElement(nsIHTMLContent** aInstancePtrResult,
 }
 
 
-nsHTMLSelectElement::nsHTMLSelectElement()
+nsHTMLSelectElement::nsHTMLSelectElement(PRBool aFromParser)
 {
-  mIsDoneAddingContent = PR_TRUE;
+  // DoneAddingChildren() will be called later if it's from the parser,
+  // otherwise it is
+  mIsDoneAddingChildren = !aFromParser;
   mArtifactsAtTopLevel = 0;
 
   mOptions = new nsHTMLOptionCollection(this);
@@ -330,7 +333,7 @@ nsHTMLSelectElement::CloneNode(PRBool aDeep, nsIDOMNode** aReturn)
   NS_ENSURE_ARG_POINTER(aReturn);
   *aReturn = nsnull;
 
-  nsHTMLSelectElement* it = new nsHTMLSelectElement();
+  nsHTMLSelectElement* it = new nsHTMLSelectElement(PR_FALSE);
 
   if (!it) {
     return NS_ERROR_OUT_OF_MEMORY;
@@ -1581,7 +1584,7 @@ nsHTMLSelectElement::NamedItem(const nsAString& aName,
 nsresult
 nsHTMLSelectElement::CheckSelectSomething()
 {
-  if (mIsDoneAddingContent) {
+  if (mIsDoneAddingChildren) {
     PRInt32 size = 1;
     GetSize(&size);
     PRBool isMultiple;
@@ -1598,7 +1601,7 @@ nsresult
 nsHTMLSelectElement::SelectSomething()
 {
   // If we're not done building the select, don't play with this yet.
-  if (!mIsDoneAddingContent) {
+  if (!mIsDoneAddingChildren) {
     return NS_OK;
   }
 
@@ -1642,33 +1645,38 @@ nsHTMLSelectElement::RemoveOption(nsIContent* aContent)
 }
 
 NS_IMETHODIMP
-nsHTMLSelectElement::IsDoneAddingContent(PRBool * aIsDone)
+nsHTMLSelectElement::IsDoneAddingChildren(PRBool * aIsDone)
 {
-  *aIsDone = mIsDoneAddingContent;
+  *aIsDone = mIsDoneAddingChildren;
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsHTMLSelectElement::DoneAddingContent(PRBool aIsDone)
+nsHTMLSelectElement::DoneAddingChildren()
 {
-  mIsDoneAddingContent = aIsDone;
+  mIsDoneAddingChildren = PR_TRUE;
 
-  nsISelectControlFrame* sFrame = GetSelectFrame();
+  nsISelectControlFrame* selectFrame = GetSelectFrame();
 
   // If we foolishly tried to restore before we were done adding
   // content, restore the rest of the options proper-like
-  if (mIsDoneAddingContent && mRestoreState) {
+  if (mRestoreState) {
     RestoreStateTo(mRestoreState);
     delete mRestoreState;
     mRestoreState = nsnull;
   }
 
-  if (sFrame) {
-    sFrame->DoneAddingContent(mIsDoneAddingContent);
+  // Notify the frame
+  if (selectFrame) {
+    selectFrame->DoneAddingChildren(PR_TRUE);
   }
 
-  // Now that we're done, select something
+  // Restore state
+  RestoreFormControlState(this, this);
+
+  // Now that we're done, select something (if it's a single select something
+  // must be selected)
   CheckSelectSomething();
 
   return NS_OK;
@@ -1803,8 +1811,7 @@ nsHTMLSelectElement::GetType(PRInt32* aType)
 }
 
 NS_IMETHODIMP
-nsHTMLSelectElement::SaveState(nsIPresContext* aPresContext,
-                               nsIPresState** aState)
+nsHTMLSelectElement::SaveState()
 {
   nsAutoString stateStr;
 
@@ -1826,24 +1833,19 @@ nsHTMLSelectElement::SaveState(nsIPresContext* aPresContext,
     }
   }
 
-  nsresult rv = GetPrimaryPresState(this, aState);
-  if (*aState) {
-    rv = (*aState)->SetStateProperty(NS_LITERAL_STRING("selecteditems"),
-                                     stateStr);
+  nsCOMPtr<nsIPresState> state;
+  nsresult rv = GetPrimaryPresState(this, getter_AddRefs(state));
+  if (state) {
+    rv = state->SetStateProperty(NS_LITERAL_STRING("selecteditems"),
+                                 stateStr);
     NS_ASSERTION(NS_SUCCEEDED(rv), "selecteditems set failed!");
   }
   return rv;
 }
 
 NS_IMETHODIMP
-nsHTMLSelectElement::RestoreState(nsIPresContext* aPresContext,
-                                  nsIPresState* aState)
+nsHTMLSelectElement::RestoreState(nsIPresState* aState)
 {
-  // XXX This works right now, but since this is only called from
-  // RestoreState() in the frame, this will happen at the first frame
-  // creation.  If JavaScript makes changes before then, and the page
-  // is being reloaded, these changes will be lost.
-  //
   // If RestoreState() is called a second time after SaveState() was
   // called, this will do nothing.
 
@@ -1880,7 +1882,7 @@ nsHTMLSelectElement::GetBoxObject(nsIBoxObject** aResult)
 nsresult
 nsHTMLSelectElement::RestoreStateTo(nsAString* aNewSelected)
 {
-  if (!mIsDoneAddingContent) {
+  if (!mIsDoneAddingChildren) {
     mRestoreState = new nsString;
     if (!mRestoreState) {
       return NS_OK;
diff --git a/mozilla/content/html/content/src/nsHTMLTextAreaElement.cpp b/mozilla/content/html/content/src/nsHTMLTextAreaElement.cpp
index 6c7cd29cb96..1db66e30086 100644
--- a/mozilla/content/html/content/src/nsHTMLTextAreaElement.cpp
+++ b/mozilla/content/html/content/src/nsHTMLTextAreaElement.cpp
@@ -73,6 +73,7 @@
 #include "nsIDOMText.h"
 #include "nsReadableUtils.h"
 #include "nsITextContent.h"
+#include "nsITextAreaElement.h"
 
 static NS_DEFINE_CID(kXULControllersCID,  NS_XULCONTROLLERS_CID);
 
@@ -80,7 +81,8 @@ static NS_DEFINE_CID(kXULControllersCID,  NS_XULCONTROLLERS_CID);
 class nsHTMLTextAreaElement : public nsGenericHTMLContainerFormElement,
                               public nsIDOMHTMLTextAreaElement,
                               public nsIDOMNSHTMLTextAreaElement,
-                              public nsITextControlElement
+                              public nsITextControlElement,
+                              public nsITextAreaElement
 {
 public:
   nsHTMLTextAreaElement();
@@ -104,13 +106,16 @@ public:
   // nsIDOMNSHTMLTextAreaElement
   NS_DECL_NSIDOMNSHTMLTEXTAREAELEMENT
 
+  // nsITextAreaElement
+  NS_DECL_NSITEXTAREAELEMENT
+
   // nsIFormControl
   NS_IMETHOD GetType(PRInt32* aType);
   NS_IMETHOD Reset();
   NS_IMETHOD SubmitNamesValues(nsIFormSubmission* aFormSubmission,
                                nsIContent* aSubmitElement);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
+  NS_IMETHOD SaveState();
+  NS_IMETHOD RestoreState(nsIPresState* aState);
 
   // nsITextControlElement
   NS_IMETHOD SetValueGuaranteed(const nsAString& aValue, nsIGfxTextControlFrame2* aFrame);
@@ -197,6 +202,7 @@ NS_HTML_CONTENT_INTERFACE_MAP_BEGIN(nsHTMLTextAreaElement,
   NS_INTERFACE_MAP_ENTRY(nsIDOMHTMLTextAreaElement)
   NS_INTERFACE_MAP_ENTRY(nsIDOMNSHTMLTextAreaElement)
   NS_INTERFACE_MAP_ENTRY(nsITextControlElement)
+  NS_INTERFACE_MAP_ENTRY(nsITextAreaElement)
   NS_INTERFACE_MAP_ENTRY_CONTENT_CLASSINFO(HTMLTextAreaElement)
 NS_HTML_CONTENT_INTERFACE_MAP_END
 
@@ -789,6 +795,14 @@ nsHTMLTextAreaElement::HandleDOMEvent(nsIPresContext* aPresContext,
   return rv;
 }
 
+// nsITextAreaElement
+NS_IMETHODIMP
+nsHTMLTextAreaElement::DoneAddingChildren()
+{
+  RestoreFormControlState(this, this);
+  return NS_OK;
+}
+
 // nsIFormControl
 
 NS_IMETHODIMP
@@ -914,30 +928,33 @@ nsHTMLTextAreaElement::SubmitNamesValues(nsIFormSubmission* aFormSubmission,
 
 
 NS_IMETHODIMP
-nsHTMLTextAreaElement::SaveState(nsIPresContext* aPresContext,
-                                 nsIPresState** aState)
+nsHTMLTextAreaElement::SaveState()
 {
-  nsresult rv = GetPrimaryPresState(this, aState);
-  if (*aState) {
-    nsString value;
-    GetValue(value);
-    // XXX Should use nsAutoString above but ConvertStringLineBreaks requires
-    // mOwnsBuffer!
-    rv = nsLinebreakConverter::ConvertStringLineBreaks(
-             value,
-             nsLinebreakConverter::eLinebreakPlatform,
-             nsLinebreakConverter::eLinebreakContent);
-    NS_ASSERTION(NS_SUCCEEDED(rv), "Converting linebreaks failed!");
-    rv = (*aState)->SetStateProperty(NS_LITERAL_STRING("value"), value);
-    NS_ASSERTION(NS_SUCCEEDED(rv), "value save failed!");
+  nsresult rv = NS_OK;
+
+  // Only save if value != defaultValue (bug 62713)
+  if (mValueChanged) {
+    nsCOMPtr<nsIPresState> state;
+    rv = GetPrimaryPresState(this, getter_AddRefs(state));
+    if (state) {
+      nsAutoString value;
+      GetValue(value);
+
+      rv = nsLinebreakConverter::ConvertStringLineBreaks(
+               value,
+               nsLinebreakConverter::eLinebreakPlatform,
+               nsLinebreakConverter::eLinebreakContent);
+      NS_ASSERTION(NS_SUCCEEDED(rv), "Converting linebreaks failed!");
+      rv = state->SetStateProperty(NS_LITERAL_STRING("value"), value);
+      NS_ASSERTION(NS_SUCCEEDED(rv), "value save failed!");
+    }
   }
 
   return rv;
 }
 
 NS_IMETHODIMP
-nsHTMLTextAreaElement::RestoreState(nsIPresContext* aPresContext,
-                                    nsIPresState* aState)
+nsHTMLTextAreaElement::RestoreState(nsIPresState* aState)
 {
   nsresult rv = NS_OK;
 
diff --git a/mozilla/content/html/document/src/nsHTMLContentSink.cpp b/mozilla/content/html/document/src/nsHTMLContentSink.cpp
index 9d4df753258..a6957980559 100644
--- a/mozilla/content/html/document/src/nsHTMLContentSink.cpp
+++ b/mozilla/content/html/document/src/nsHTMLContentSink.cpp
@@ -123,6 +123,7 @@
 #include "nsIParserService.h"
 #include "nsParserCIID.h"
 #include "nsISelectElement.h"
+#include "nsITextAreaElement.h"
 
 #include "nsIPref.h"
 
@@ -810,8 +811,9 @@ MakeContentObject(nsHTMLTag aNodeType,
                   nsIDOMHTMLFormElement* aForm,
                   nsIWebShell* aWebShell,
                   nsIHTMLContent** aResult,
-                  const nsAString* aSkippedContent = nsnull,
-                  PRBool aInsideNoXXXTag = PR_FALSE);
+                  const nsAString* aSkippedContent,
+                  PRBool aInsideNoXXXTag,
+                  PRBool aFromParser);
 
 
 /**
@@ -858,7 +860,8 @@ HTMLContentSink::CreateContentObject(const nsIParserNode& aNode,
     }
     // Make the content object
     rv = MakeContentObject(aNodeType, nodeInfo, aForm, aWebShell,
-                           aResult, skippedContent, !!mInsideNoXXXTag);
+                           aResult, skippedContent, !!mInsideNoXXXTag,
+                           PR_TRUE);
 
     PRInt32 id;
     mDocument->GetAndIncrementContentID(&id);
@@ -895,7 +898,7 @@ NS_CreateHTMLElement(nsIHTMLContent** aResult, nsINodeInfo *aNodeInfo,
 
     if (aCaseSensitive) {
       rv = MakeContentObject(nsHTMLTag(id), aNodeInfo, nsnull, nsnull,
-                             aResult);
+                             aResult, nsnull, PR_FALSE, PR_FALSE);
     } else {
       // Revese map id to name to get the correct character case in
       // the tag name.
@@ -922,7 +925,8 @@ NS_CreateHTMLElement(nsIHTMLContent** aResult, nsINodeInfo *aNodeInfo,
         }
       }
 
-      rv = MakeContentObject(nsHTMLTag(id), nodeInfo, nsnull, nsnull, aResult);
+      rv = MakeContentObject(nsHTMLTag(id), nodeInfo, nsnull, nsnull, aResult,
+                             nsnull, PR_FALSE, PR_FALSE);
     }
   }
 
@@ -994,7 +998,8 @@ MakeContentObject(nsHTMLTag aNodeType,
                   nsIWebShell* aWebShell,
                   nsIHTMLContent** aResult,
                   const nsAString* aSkippedContent,
-                  PRBool aInsideNoXXXTag)
+                  PRBool aInsideNoXXXTag,
+                  PRBool aFromParser)
 {
   nsresult rv = NS_OK;
   switch (aNodeType) {
@@ -1105,7 +1110,7 @@ MakeContentObject(nsHTMLTag aNodeType,
     rv = NS_NewHTMLImageElement(aResult, aNodeInfo);
     break;
   case eHTMLTag_input:
-    rv = NS_NewHTMLInputElement(aResult, aNodeInfo);
+    rv = NS_NewHTMLInputElement(aResult, aNodeInfo, aFromParser);
     if (!aInsideNoXXXTag)
       SetForm(*aResult, aForm);
     break;
@@ -1170,7 +1175,7 @@ MakeContentObject(nsHTMLTag aNodeType,
     rv = NS_NewHTMLScriptElement(aResult, aNodeInfo);
     break;
   case eHTMLTag_select:
-    rv = NS_NewHTMLSelectElement(aResult, aNodeInfo);
+    rv = NS_NewHTMLSelectElement(aResult, aNodeInfo, aFromParser);
     if (!aInsideNoXXXTag) {
       SetForm(*aResult, aForm);
     }
@@ -1421,13 +1426,6 @@ SinkContext::OpenContainer(const nsIParserNode& aNode)
     return rv;
   }
 
-  if (nodeType == eHTMLTag_select) {
-    nsCOMPtr<nsISelectElement> select(do_QueryInterface(content));
-    if (select) {
-      select->DoneAddingContent(PR_FALSE);
-    }
-  }
-
   mStack[mStackPos].mType = nodeType;
   mStack[mStackPos].mContent = content;
   mStack[mStackPos].mFlags = 0;
@@ -1607,9 +1605,8 @@ SinkContext::CloseContainer(const nsIParserNode& aNode)
     case eHTMLTag_select:
       {
         nsCOMPtr<nsISelectElement> select = do_QueryInterface(content, &result);
-
-        if (NS_SUCCEEDED(result)) {
-          result = select->DoneAddingContent(PR_TRUE);
+        if (select) {
+          result = select->DoneAddingChildren();
         }
       }
       break;
@@ -1884,6 +1881,22 @@ SinkContext::AddLeaf(const nsIParserNode& aNode)
 
       // Add new leaf to its parent
       AddLeaf(content);
+
+      // Notify input and button that they are now fully created
+      switch (nodeType) {
+      case eHTMLTag_input:
+      case eHTMLTag_button:
+        content->DoneCreatingElement();
+        break;
+      case eHTMLTag_textarea:
+        // XXX textarea deserves to be treated like the container it is.
+        nsCOMPtr<nsITextAreaElement> textarea(do_QueryInterface(content));
+        if (textarea) {
+          textarea->DoneAddingChildren();
+        }
+        break;
+      }
+
       NS_RELEASE(content);
     }
     break;
diff --git a/mozilla/content/xul/content/src/nsXULElement.cpp b/mozilla/content/xul/content/src/nsXULElement.cpp
index 079e5210435..468fbdbd2f0 100644
--- a/mozilla/content/xul/content/src/nsXULElement.cpp
+++ b/mozilla/content/xul/content/src/nsXULElement.cpp
@@ -1880,6 +1880,11 @@ nsXULElement::HandleEvent(nsIDOMEvent *aEvent)
   return DispatchEvent(aEvent, &noDefault);
 }
 
+NS_IMETHODIMP
+nsXULElement::DoneCreatingElement()
+{
+  return NS_OK;
+}
 
 //----------------------------------------------------------------------
 // nsIScriptEventHandlerOwner interface
diff --git a/mozilla/content/xul/content/src/nsXULElement.h b/mozilla/content/xul/content/src/nsXULElement.h
index 5cbc1084f9d..c64173eb132 100644
--- a/mozilla/content/xul/content/src/nsXULElement.h
+++ b/mozilla/content/xul/content/src/nsXULElement.h
@@ -389,6 +389,7 @@ public:
                               nsIDOMEvent** aDOMEvent,
                               PRUint32 aFlags,
                               nsEventStatus* aEventStatus);
+    NS_IMETHOD DoneCreatingElement();
 
     NS_IMETHOD GetContentID(PRUint32* aID);
     NS_IMETHOD SetContentID(PRUint32 aID);
diff --git a/mozilla/layout/base/nsFrameManager.cpp b/mozilla/layout/base/nsFrameManager.cpp
index 6722328e9a5..cfcb8f660e2 100644
--- a/mozilla/layout/base/nsFrameManager.cpp
+++ b/mozilla/layout/base/nsFrameManager.cpp
@@ -71,6 +71,7 @@
 #include "nsIContentList.h"
 #include "nsReadableUtils.h"
 #include "nsUnicharUtils.h"
+#include "nsPrintfCString.h"
 
   #ifdef DEBUG
     #undef NOISY_DEBUG
@@ -366,7 +367,7 @@ public:
                                nsIStatefulFrame::SpecialStateID aID = nsIStatefulFrame::eNoID);
   NS_IMETHOD GenerateStateKey(nsIContent* aContent,
                               nsIStatefulFrame::SpecialStateID aID,
-                              nsCString& aString);
+                              nsACString& aString);
 
   // Gets and sets properties on a given frame
   NS_IMETHOD GetFrameProperty(nsIFrame* aFrame,
@@ -2048,14 +2049,14 @@ FrameManager::RestoreFrameState(nsIPresContext* aPresContext, nsIFrame* aFrame,
 }
 
 
-static inline void KeyAppendSep(nsCString& aKey)
+static inline void KeyAppendSep(nsACString& aKey)
 {
   if (!aKey.IsEmpty()) {
-    aKey.Append(">");
+    aKey.Append('>');
   }
 }
 
-static inline void KeyAppendString(const nsAString& aString, nsCString& aKey)
+static inline void KeyAppendString(const nsAString& aString, nsACString& aKey)
 {
   KeyAppendSep(aKey);
 
@@ -2065,14 +2066,14 @@ static inline void KeyAppendString(const nsAString& aString, nsCString& aKey)
   aKey.Append(NS_ConvertUCS2toUTF8(aString));
 }
 
-static inline void KeyAppendInt(PRInt32 aInt, nsCString& aKey)
+static inline void KeyAppendInt(PRInt32 aInt, nsACString& aKey)
 {
   KeyAppendSep(aKey);
 
-  aKey.AppendInt(aInt);
+  aKey.Append(nsPrintfCString("%d", aInt));
 }
 
-static inline void KeyAppendAtom(nsIAtom* aAtom, nsCString& aKey)
+static inline void KeyAppendAtom(nsIAtom* aAtom, nsACString& aKey)
 {
   NS_PRECONDITION(aAtom, "KeyAppendAtom: aAtom can not be null!\n");
 
@@ -2093,7 +2094,7 @@ static inline PRBool IsAutocompleteOff(nsIDOMElement* aElement)
 NS_IMETHODIMP
 FrameManager::GenerateStateKey(nsIContent* aContent,
                                nsIStatefulFrame::SpecialStateID aID,
-                               nsCString& aKey)
+                               nsACString& aKey)
 {
   aKey.Truncate();
 
diff --git a/mozilla/layout/base/public/nsIFrameManager.h b/mozilla/layout/base/public/nsIFrameManager.h
index 8f3f4ccec68..257deeacbf1 100644
--- a/mozilla/layout/base/public/nsIFrameManager.h
+++ b/mozilla/layout/base/public/nsIFrameManager.h
@@ -202,7 +202,7 @@ public:
                                nsIStatefulFrame::SpecialStateID aID = nsIStatefulFrame::eNoID) = 0;
   NS_IMETHOD GenerateStateKey(nsIContent* aContent,
                               nsIStatefulFrame::SpecialStateID aID,
-                              nsCString& aString) = 0;
+                              nsACString& aString) = 0;
 
 
   /**
diff --git a/mozilla/layout/forms/nsComboboxControlFrame.cpp b/mozilla/layout/forms/nsComboboxControlFrame.cpp
index 080ac754819..564fb28ad4f 100644
--- a/mozilla/layout/forms/nsComboboxControlFrame.cpp
+++ b/mozilla/layout/forms/nsComboboxControlFrame.cpp
@@ -1872,7 +1872,6 @@ nsComboboxControlFrame::GetDropDown(nsIFrame** aDropDownFrame)
 NS_IMETHODIMP 
 nsComboboxControlFrame::ToggleList(nsIPresContext* aPresContext)
 {
-
   ShowList(aPresContext, (PR_FALSE == mDroppedDown));
 
   return NS_OK;
@@ -1996,7 +1995,7 @@ nsComboboxControlFrame::GetIndexOfDisplayArea(PRInt32* aSelectedIndex)
 // nsISelectControlFrame
 //----------------------------------------------------------------------
 NS_IMETHODIMP
-nsComboboxControlFrame::DoneAddingContent(PRBool aIsDone)
+nsComboboxControlFrame::DoneAddingChildren(PRBool aIsDone)
 {
   nsISelectControlFrame* listFrame = nsnull;
   nsresult rv = NS_ERROR_FAILURE;
@@ -2004,7 +2003,7 @@ nsComboboxControlFrame::DoneAddingContent(PRBool aIsDone)
     rv = mDropdownFrame->QueryInterface(NS_GET_IID(nsISelectControlFrame), 
                                                 (void**)&listFrame);
     if (NS_SUCCEEDED(rv) && listFrame) {
-      rv = listFrame->DoneAddingContent(aIsDone);
+      rv = listFrame->DoneAddingChildren(aIsDone);
       NS_RELEASE(listFrame);
     }
   }
@@ -2672,6 +2671,7 @@ nsComboboxControlFrame::SaveState(nsIPresContext* aPresContext,
                                   nsIPresState** aState)
 {
   nsCOMPtr<nsIStatefulFrame> stateful(do_QueryInterface(mListControlFrame));
+  NS_ASSERTION(stateful, "Couldn't cast list frame to stateful frame!!!");
   if (stateful) {
     return stateful->SaveState(aPresContext, aState);
   }
@@ -2689,6 +2689,5 @@ nsComboboxControlFrame::RestoreState(nsIPresContext* aPresContext,
   nsresult rv = CallQueryInterface(mListControlFrame, &stateful);
   NS_ASSERTION(NS_SUCCEEDED(rv), "Must implement nsIStatefulFrame");
   rv = stateful->RestoreState(aPresContext, aState);
-  InitTextStr();
   return rv;
 }
diff --git a/mozilla/layout/forms/nsComboboxControlFrame.h b/mozilla/layout/forms/nsComboboxControlFrame.h
index 6dad9aa76d6..cf286d7237c 100644
--- a/mozilla/layout/forms/nsComboboxControlFrame.h
+++ b/mozilla/layout/forms/nsComboboxControlFrame.h
@@ -188,7 +188,7 @@ public:
   NS_IMETHOD AddOption(nsIPresContext* aPresContext, PRInt32 index);
   NS_IMETHOD RemoveOption(nsIPresContext* aPresContext, PRInt32 index);
   NS_IMETHOD GetOptionSelected(PRInt32 aIndex, PRBool* aValue);
-  NS_IMETHOD DoneAddingContent(PRBool aIsDone);
+  NS_IMETHOD DoneAddingChildren(PRBool aIsDone);
   NS_IMETHOD OnOptionSelected(nsIPresContext* aPresContext,
                               PRInt32 aIndex,
                               PRBool aSelected);
diff --git a/mozilla/layout/forms/nsFileControlFrame.cpp b/mozilla/layout/forms/nsFileControlFrame.cpp
index df4cf0aaa5d..87911fd302d 100644
--- a/mozilla/layout/forms/nsFileControlFrame.cpp
+++ b/mozilla/layout/forms/nsFileControlFrame.cpp
@@ -63,7 +63,6 @@
 #include "nsIDOMMouseListener.h"
 #include "nsIPresShell.h"
 #include "nsIDOMHTMLInputElement.h"
-#include "nsIStatefulFrame.h"
 #include "nsISupportsPrimitives.h"
 #include "nsIComponentManager.h"
 #include "nsIDOMWindowInternal.h"
@@ -149,10 +148,16 @@ nsFileControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
 
   if (NS_SUCCEEDED(rv)) {
     mTextContent->SetAttr(kNameSpaceID_None, nsHTMLAtoms::type, NS_LITERAL_STRING("text"), PR_FALSE);
-    if (nsFormFrame::GetDisabled(this)) {
-      nsCOMPtr<nsIDOMHTMLInputElement> textControl = do_QueryInterface(mTextContent);
-      if (textControl) {
-        textControl->SetDisabled(nsFormFrame::GetDisabled(this));
+    nsCOMPtr<nsIDOMHTMLInputElement> textControl = do_QueryInterface(mTextContent);
+    if (textControl) {
+      textControl->SetDisabled(nsFormFrame::GetDisabled(this));
+      // Initialize value when we create the content in case the value was set
+      // before we got here
+      nsCOMPtr<nsIDOMHTMLInputElement> fileContent = do_QueryInterface(mContent);
+      if (fileContent) {
+        nsAutoString value;
+        fileContent->GetValue(value);
+        textControl->SetValue(value);
       }
     }
     aChildList.AppendElement(mTextContent);
@@ -199,9 +204,6 @@ nsFileControlFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
   } else  if (aIID.Equals(NS_GET_IID(nsIDOMMouseListener))) {
     *aInstancePtr = (void*)(nsIDOMMouseListener*) this;
     return NS_OK;
-  } else  if (aIID.Equals(NS_GET_IID(nsIStatefulFrame))) {
-    *aInstancePtr = (void*)(nsIStatefulFrame*) this;
-    return NS_OK;
   }
   return nsHTMLContainerFrame::QueryInterface(aIID, aInstancePtr);
 }
@@ -678,54 +680,6 @@ nsFileControlFrame::Paint(nsIPresContext*      aPresContext,
   return nsFrame::Paint(aPresContext, aRenderingContext, aDirtyRect, aWhichLayer);
 }
 
-//----------------------------------------------------------------------
-// nsIStatefulFrame
-//----------------------------------------------------------------------
-NS_IMETHODIMP
-nsFileControlFrame::SaveState(nsIPresContext* aPresContext, nsIPresState** aState)
-{
-  NS_ENSURE_ARG_POINTER(aState);
-
-  // Don't save state before we are initialized
-  if (!mTextFrame && !mCachedState) {
-    return NS_OK;
-  }
-
-  // Get the value string
-  nsAutoString stateString;
-  nsresult res = GetProperty(nsHTMLAtoms::value, stateString);
-  NS_ENSURE_SUCCESS(res, res);
-
-  // Compare to default value, and only save if needed (Bug 62713)
-  nsAutoString defaultStateString;
-  nsCOMPtr<nsIDOMHTMLInputElement> formControl(do_QueryInterface(mContent));
-  if (formControl) {
-    formControl->GetDefaultValue(defaultStateString);
-  }
-
-  if (! stateString.Equals(defaultStateString)) {
-
-    // Construct a pres state and store value in it.
-    res = NS_NewPresState(aState);
-    NS_ENSURE_SUCCESS(res, res);
-    res = (*aState)->SetStateProperty(NS_LITERAL_STRING("value"), stateString);
-  }
-
-  return res;
-}
-
-NS_IMETHODIMP
-nsFileControlFrame::RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
-{
-  NS_ENSURE_ARG_POINTER(aState);
-
-  nsAutoString string;
-  aState->GetStateProperty(NS_LITERAL_STRING("value"), string);
-  SetProperty(aPresContext, nsHTMLAtoms::value, string);
-
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 nsFileControlFrame::OnContentReset()
 {
diff --git a/mozilla/layout/forms/nsFileControlFrame.h b/mozilla/layout/forms/nsFileControlFrame.h
index 7c21d161089..56bfd7833d3 100644
--- a/mozilla/layout/forms/nsFileControlFrame.h
+++ b/mozilla/layout/forms/nsFileControlFrame.h
@@ -42,7 +42,6 @@
 #include "nsIFormControlFrame.h"
 #include "nsIDOMMouseListener.h"
 #include "nsIAnonymousContentCreator.h"
-#include "nsIStatefulFrame.h"
 #include "nsCOMPtr.h"
 #include "nsIHTMLContent.h"
 
@@ -57,9 +56,7 @@ class nsISupportsArray;
 class nsFileControlFrame : public nsAreaFrame,
                            public nsIFormControlFrame,
                            public nsIDOMMouseListener,
-                           public nsIAnonymousContentCreator,
-                           public nsIStatefulFrame
-
+                           public nsIAnonymousContentCreator
 {
 public:
   nsFileControlFrame();
@@ -183,10 +180,6 @@ public:
 
   NS_IMETHOD HandleEvent(nsIDOMEvent* aEvent) { return NS_OK; }
 
-  //nsIStatefulFrame
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
-
 protected:
   virtual PRIntn GetSkipSides() const;
 
diff --git a/mozilla/layout/forms/nsFormControlHelper.cpp b/mozilla/layout/forms/nsFormControlHelper.cpp
index 763b8a94504..35a8406481a 100644
--- a/mozilla/layout/forms/nsFormControlHelper.cpp
+++ b/mozilla/layout/forms/nsFormControlHelper.cpp
@@ -892,37 +892,3 @@ nsFormControlHelper::Reset(nsIFrame* aFrame, nsIPresContext* aPresContext)
   return NS_ERROR_FAILURE;
 }
 
-nsresult
-nsFormControlHelper::SaveContentState(nsIFrame* aFrame,
-                                      nsIPresContext* aPresContext,
-                                      nsIPresState** aState)
-{
-  nsCOMPtr<nsIContent> controlContent;
-  aFrame->GetContent(getter_AddRefs(controlContent));
-
-  nsCOMPtr<nsIFormControl> control = do_QueryInterface(controlContent);
-  if (control) {
-    control->SaveState(aPresContext, aState);
-    return NS_OK;
-  }
-
-  return NS_ERROR_FAILURE;
-}
-
-nsresult
-nsFormControlHelper::RestoreContentState(nsIFrame* aFrame,
-                                         nsIPresContext* aPresContext,
-                                         nsIPresState* aState)
-{
-  nsCOMPtr<nsIContent> controlContent;
-  aFrame->GetContent(getter_AddRefs(controlContent));
-
-  nsCOMPtr<nsIFormControl> control = do_QueryInterface(controlContent);
-  if (control) {
-    control->RestoreState(aPresContext, aState);
-    return NS_OK;
-  }
-
-  NS_NOTREACHED("no content");
-  return NS_ERROR_FAILURE;
-}
diff --git a/mozilla/layout/forms/nsFormControlHelper.h b/mozilla/layout/forms/nsFormControlHelper.h
index f5f8bec6a40..cfe795743fc 100644
--- a/mozilla/layout/forms/nsFormControlHelper.h
+++ b/mozilla/layout/forms/nsFormControlHelper.h
@@ -160,12 +160,6 @@ public:
   static nsresult GetName(nsIContent* aContent, nsAString* aResult);
   static nsresult GetInputElementValue(nsIContent* aContent, nsString* aText, PRBool aInitialValue);
   static nsresult Reset(nsIFrame* aFrame, nsIPresContext* aPresContext);
-  static nsresult SaveContentState(nsIFrame* aFrame,
-                                   nsIPresContext* aPresContext,
-                                   nsIPresState** aState);
-  static nsresult RestoreContentState(nsIFrame* aFrame,
-                                      nsIPresContext* aPresContext,
-                                      nsIPresState* aState);
 
  /** 
   * Utility to convert a string to a PRBool
diff --git a/mozilla/layout/forms/nsGfxButtonControlFrame.cpp b/mozilla/layout/forms/nsGfxButtonControlFrame.cpp
index 562c2b824bc..0945f49b119 100644
--- a/mozilla/layout/forms/nsGfxButtonControlFrame.cpp
+++ b/mozilla/layout/forms/nsGfxButtonControlFrame.cpp
@@ -466,8 +466,6 @@ nsGfxButtonControlFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
 
   if (aIID.Equals(NS_GET_IID(nsIAnonymousContentCreator))) {
     *aInstancePtr = NS_STATIC_CAST(nsIAnonymousContentCreator*, this);
-  } else if (aIID.Equals(NS_GET_IID(nsIStatefulFrame))) {
-    *aInstancePtr = NS_STATIC_CAST(nsIStatefulFrame*, this);
   }
 else {
     return nsHTMLButtonControlFrame::QueryInterface(aIID, aInstancePtr);
@@ -651,48 +649,3 @@ nsGfxButtonControlFrame::HandleEvent(nsIPresContext* aPresContext,
   
   return NS_OK;
 }
-
-//----------------------------------------------------------------------
-// nsIStatefulFrame
-//----------------------------------------------------------------------
-NS_IMETHODIMP
-nsGfxButtonControlFrame::SaveState(nsIPresContext* aPresContext, nsIPresState** aState)
-{
-  NS_ENSURE_ARG_POINTER(aState);
-
-  // Get the value string
-  nsAutoString stateString;
-  nsresult res = GetProperty(nsHTMLAtoms::value, stateString);
-  NS_ENSURE_SUCCESS(res, res);
-
-  // Compare to default value, and only save if needed (Bug 62713)
-  NS_ENSURE_TRUE(mContent->IsContentOfType(nsIContent::eHTML_FORM_CONTROL),
-                 NS_ERROR_UNEXPECTED);
-  nsAutoString defaultStateString;
-  if (!mDefaultValueWasChanged) {
-    mContent->GetAttr(kNameSpaceID_None, nsHTMLAtoms::value, defaultStateString);
-  }
-
-  if (mDefaultValueWasChanged || !stateString.Equals(defaultStateString)) {
-
-    // Construct a pres state and store value in it.
-    res = NS_NewPresState(aState);
-    NS_ENSURE_SUCCESS(res, res);
-    res = (*aState)->SetStateProperty(NS_LITERAL_STRING("value"), stateString);
-  }
-
-  return res;
-}
-
-NS_IMETHODIMP
-nsGfxButtonControlFrame::RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
-{
-  NS_ENSURE_ARG_POINTER(aState);
-
-  // Set the value to the stored state.
-  nsAutoString stateString;
-  nsresult res = aState->GetStateProperty(NS_LITERAL_STRING("value"), stateString);
-  NS_ENSURE_SUCCESS(res, res);
-
-  return SetProperty(aPresContext, nsHTMLAtoms::value, stateString);
-}
diff --git a/mozilla/layout/forms/nsGfxButtonControlFrame.h b/mozilla/layout/forms/nsGfxButtonControlFrame.h
index cf88e5c95bc..2f0b32bf4bd 100644
--- a/mozilla/layout/forms/nsGfxButtonControlFrame.h
+++ b/mozilla/layout/forms/nsGfxButtonControlFrame.h
@@ -43,7 +43,6 @@
 #include "nsCOMPtr.h"
 #include "nsIAnonymousContentCreator.h"
 #include "nsITextContent.h"
-#include "nsIStatefulFrame.h"
 
 #ifdef ACCESSIBILITY
 class nsIAccessible;
@@ -57,8 +56,7 @@ class nsIAccessible;
 class nsIPresState;
 
 class nsGfxButtonControlFrame : public nsHTMLButtonControlFrame,
-                                public nsIAnonymousContentCreator,
-                                public nsIStatefulFrame
+                                public nsIAnonymousContentCreator
 {
 public:
   nsGfxButtonControlFrame();
@@ -117,10 +115,6 @@ protected:
   virtual PRBool IsSubmit(PRInt32 type);
   virtual PRBool IsBrowse(PRInt32 type); // Browse button of file input
 
-  //nsIStatefulFrame
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
-
 private:
   NS_IMETHOD_(nsrefcnt) AddRef() { return NS_OK; }
   NS_IMETHOD_(nsrefcnt) Release() { return NS_OK; }
diff --git a/mozilla/layout/forms/nsGfxCheckboxControlFrame.cpp b/mozilla/layout/forms/nsGfxCheckboxControlFrame.cpp
index a0de56439aa..86a36c4a4ba 100644
--- a/mozilla/layout/forms/nsGfxCheckboxControlFrame.cpp
+++ b/mozilla/layout/forms/nsGfxCheckboxControlFrame.cpp
@@ -96,10 +96,7 @@ nsGfxCheckboxControlFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr
   NS_ASSERTION(aInstancePtr, "QueryInterface requires a non-NULL destination!");
   if ( !aInstancePtr )
     return NS_ERROR_NULL_POINTER;
-  if (aIID.Equals(NS_GET_IID(nsIStatefulFrame))) {
-    *aInstancePtr = (void*)(nsIStatefulFrame*) this;
-    return NS_OK;
-  }
+
   if (aIID.Equals(NS_GET_IID(nsICheckboxControlFrame))) {
     *aInstancePtr = (void*) ((nsICheckboxControlFrame*) this);
     return NS_OK;
@@ -275,21 +272,6 @@ nsGfxCheckboxControlFrame::GetCheckboxState ( )
   return retval;
 }
 
-//----------------------------------------------------------------------
-// nsIStatefulFrame
-//----------------------------------------------------------------------
-NS_IMETHODIMP nsGfxCheckboxControlFrame::SaveState(nsIPresContext* aPresContext,
-                                                nsIPresState** aState)
-{
-  return nsFormControlHelper::SaveContentState(this, aPresContext, aState);
-}
-
-NS_IMETHODIMP nsGfxCheckboxControlFrame::RestoreState(nsIPresContext* aPresContext,
-                                                   nsIPresState* aState)
-{
-  return nsFormControlHelper::RestoreContentState(this, aPresContext, aState);
-}
-
 //------------------------------------------------------------
 // Extra Debug Methods
 //------------------------------------------------------------
diff --git a/mozilla/layout/forms/nsGfxCheckboxControlFrame.h b/mozilla/layout/forms/nsGfxCheckboxControlFrame.h
index 16549d7ddd0..80e8bd7a67e 100644
--- a/mozilla/layout/forms/nsGfxCheckboxControlFrame.h
+++ b/mozilla/layout/forms/nsGfxCheckboxControlFrame.h
@@ -38,7 +38,6 @@
 #define nsGfxCheckboxControlFrame_h___
 
 #include "nsFormControlFrame.h"
-#include "nsIStatefulFrame.h"
 #include "nsICheckboxControlFrame.h"
 
 #ifdef ACCESSIBILITY
@@ -50,7 +49,6 @@ class nsIAccessible;
 #define NS_GFX_CHECKBOX_CONTROL_FRAME_LAST_CONTEXT_INDEX   0
 
 class nsGfxCheckboxControlFrame : public nsFormControlFrame,
-                                  public nsIStatefulFrame,
                                   public nsICheckboxControlFrame//,
                                   //public nsIAccessible
 {
@@ -90,11 +88,7 @@ public:
     // nsIFormControlFrame
   NS_IMETHOD OnContentReset();
 
-   // nsIStatefulFrame
   NS_IMETHOD QueryInterface(const nsIID& aIID, void** aInstancePtr);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
-
 
 #ifdef DEBUG_rodsXXX
   NS_IMETHOD Reflow(nsIPresContext*          aCX,
diff --git a/mozilla/layout/forms/nsGfxRadioControlFrame.cpp b/mozilla/layout/forms/nsGfxRadioControlFrame.cpp
index 5e0f9b7d33e..89f0ae2c598 100644
--- a/mozilla/layout/forms/nsGfxRadioControlFrame.cpp
+++ b/mozilla/layout/forms/nsGfxRadioControlFrame.cpp
@@ -94,10 +94,6 @@ nsGfxRadioControlFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
     *aInstancePtr = (void*) ((nsIRadioControlFrame*) this);
     return NS_OK;
   }
-  if (aIID.Equals(NS_GET_IID(nsIStatefulFrame))) {
-    *aInstancePtr = (void*) ((nsIStatefulFrame*) this);
-    return NS_OK;
-  }
 
   return nsFormControlFrame::QueryInterface(aIID, aInstancePtr);
 }
@@ -257,25 +253,6 @@ nsGfxRadioControlFrame::OnChecked(nsIPresContext* aPresContext,
   return NS_OK;
 }
 
-//----------------------------------------------------------------------
-// nsIStatefulFrame
-//----------------------------------------------------------------------
-NS_IMETHODIMP
-nsGfxRadioControlFrame::SaveState(nsIPresContext* aPresContext,
-                                  nsIPresState** aState)
-{
-  return nsFormControlHelper::SaveContentState(this, aPresContext, aState);
-}
-        
-
-
-//----------------------------------------------------------------------
-NS_IMETHODIMP
-nsGfxRadioControlFrame::RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
-{
-  return nsFormControlHelper::RestoreContentState(this, aPresContext, aState);
-}
-
 
 //----------------------------------------------------------------------
 // Extra Debug Helper Methods
diff --git a/mozilla/layout/forms/nsGfxRadioControlFrame.h b/mozilla/layout/forms/nsGfxRadioControlFrame.h
index 372fbc5d6a6..b04f5debf6d 100644
--- a/mozilla/layout/forms/nsGfxRadioControlFrame.h
+++ b/mozilla/layout/forms/nsGfxRadioControlFrame.h
@@ -39,7 +39,6 @@
 #define nsGfxRadioControlFrame_h___
 
 #include "nsFormControlFrame.h"
-#include "nsIStatefulFrame.h"
 #include "nsIRadioControlFrame.h"
 
 #ifdef ACCESSIBILITY
@@ -52,7 +51,6 @@ class nsIAccessible;
 #define NS_GFX_RADIO_CONTROL_FRAME_LAST_CONTEXT_INDEX   0
 
 class nsGfxRadioControlFrame : public nsFormControlFrame,
-                               public nsIStatefulFrame,
                                public nsIRadioControlFrame
 
 {
@@ -97,10 +95,6 @@ public:
   // nsIFormControlFrame
   NS_IMETHOD OnContentReset();
 
-  //nsIStatefulFrame
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
-
   ///XXX: End o the temporary methods
 #ifdef DEBUG_rodsXXX
   NS_IMETHOD Reflow(nsIPresContext*          aCX,
diff --git a/mozilla/layout/forms/nsISelectControlFrame.h b/mozilla/layout/forms/nsISelectControlFrame.h
index aa9a701b30a..8c840ada778 100644
--- a/mozilla/layout/forms/nsISelectControlFrame.h
+++ b/mozilla/layout/forms/nsISelectControlFrame.h
@@ -74,9 +74,10 @@ public:
   NS_IMETHOD GetOptionSelected(PRInt32 index, PRBool* value) = 0;
 
   /**
-   * Sets the select state of the option at index
+   * Sets whether the parser is done adding children
+   * @param aIsDone whether the parser is done adding children
    */
-  NS_IMETHOD DoneAddingContent(PRBool aIsDone) = 0;
+  NS_IMETHOD DoneAddingChildren(PRBool aIsDone) = 0;
 
   /**
    * Notify the frame when an option is selected
diff --git a/mozilla/layout/forms/nsListControlFrame.cpp b/mozilla/layout/forms/nsListControlFrame.cpp
index 96e0f9d82c4..0dcff1613f2 100644
--- a/mozilla/layout/forms/nsListControlFrame.cpp
+++ b/mozilla/layout/forms/nsListControlFrame.cpp
@@ -553,10 +553,6 @@ nsListControlFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
     *aInstancePtr = (void*)(nsIDOMKeyListener*) this;                                        
     return NS_OK;                                                        
   }
-  if (aIID.Equals(NS_GET_IID(nsIStatefulFrame))) {
-    *aInstancePtr = (void*)(nsIStatefulFrame*) this;
-    return NS_OK;
-  }
   return nsScrollFrame::QueryInterface(aIID, aInstancePtr);
 }
 
@@ -1453,7 +1449,7 @@ nsListControlFrame::SetInitialChildList(nsIPresContext* aPresContext,
   // First check to see if all the content has been added
   nsCOMPtr<nsISelectElement> element(do_QueryInterface(mContent));
   if (element) {
-    element->IsDoneAddingContent(&mIsAllContentHere);
+    element->IsDoneAddingChildren(&mIsAllContentHere);
     if (!mIsAllContentHere) {
       mIsAllFramesHere    = PR_FALSE;
       mHasBeenInitialized = PR_FALSE;
@@ -1969,7 +1965,7 @@ PRBool nsListControlFrame::CheckIfAllFramesHere()
 
 //-------------------------------------------------------------------
 NS_IMETHODIMP
-nsListControlFrame::DoneAddingContent(PRBool aIsDone)
+nsListControlFrame::DoneAddingChildren(PRBool aIsDone)
 {
   mIsAllContentHere = aIsDone;
   if (mIsAllContentHere) {
@@ -2003,7 +1999,7 @@ nsListControlFrame::AddOption(nsIPresContext* aPresContext, PRInt32 aIndex)
   if (!mIsAllContentHere) {
     nsCOMPtr<nsISelectElement> element(do_QueryInterface(mContent));
     if (element) {
-      element->IsDoneAddingContent(&mIsAllContentHere);
+      element->IsDoneAddingChildren(&mIsAllContentHere);
       if (!mIsAllContentHere) {
         mIsAllFramesHere    = PR_FALSE;
         mHasBeenInitialized = PR_FALSE;
@@ -2775,15 +2771,8 @@ nsListControlFrame::MouseDown(nsIDOMEvent* aMouseEvent)
       if (NS_SUCCEEDED(mPresContext->GetEventStateManager(getter_AddRefs(stateManager)))) {
         nsIFrame * frame;
         stateManager->GetEventTarget(&frame);
-        nsCOMPtr<nsIListControlFrame> listFrame(do_QueryInterface(frame));
-        if (listFrame) {
-          if (!IsClickingInCombobox(aMouseEvent)) {
-            return NS_OK;
-          }
-        } else {
-          if (!IsClickingInCombobox(aMouseEvent)) {
-            return NS_OK;
-          }
+        if (!IsClickingInCombobox(aMouseEvent)) {
+          return NS_OK;
         }
         // This will consume the focus event we get from the clicking on the dropdown
         //stateManager->ConsumeFocusEvents(PR_TRUE);
@@ -3575,21 +3564,3 @@ nsListControlFrame::ItemsHaveBeenRemoved(nsIPresContext * aPresContext)
     ResetList(aPresContext);
   }
 }
-
-
-//--------------------------------------------------------
-// nsIStatefulFrame
-//--------------------------------------------------------
-NS_IMETHODIMP
-nsListControlFrame::SaveState(nsIPresContext* aPresContext,
-                              nsIPresState** aState)
-{
-  return nsFormControlHelper::SaveContentState(this, aPresContext, aState);
-}
-
-NS_IMETHODIMP
-nsListControlFrame::RestoreState(nsIPresContext* aPresContext,
-                                 nsIPresState* aState)
-{
-  return nsFormControlHelper::RestoreContentState(this, aPresContext, aState);
-}
diff --git a/mozilla/layout/forms/nsListControlFrame.h b/mozilla/layout/forms/nsListControlFrame.h
index 95784d6707e..e6c93e4d526 100644
--- a/mozilla/layout/forms/nsListControlFrame.h
+++ b/mozilla/layout/forms/nsListControlFrame.h
@@ -58,7 +58,6 @@
 #include "nsIPresState.h"
 #include "nsCWeakReference.h"
 #include "nsIContent.h"
-#include "nsIStatefulFrame.h"
 
 class nsIDOMHTMLSelectElement;
 class nsIDOMHTMLCollection;
@@ -68,7 +67,6 @@ class nsIViewManager;
 class nsIPresContext;
 class nsVoidArray;
 class nsIScrollableView;
-class nsIStatefulFrame;
 
 class nsListControlFrame;
 class nsSelectUpdateTimer;
@@ -283,7 +281,7 @@ public:
   NS_IMETHOD AddOption(nsIPresContext* aPresContext, PRInt32 index);
   NS_IMETHOD RemoveOption(nsIPresContext* aPresContext, PRInt32 index);
   NS_IMETHOD GetOptionSelected(PRInt32 aIndex, PRBool* aValue);
-  NS_IMETHOD DoneAddingContent(PRBool aIsDone);
+  NS_IMETHOD DoneAddingChildren(PRBool aIsDone);
   NS_IMETHOD OnOptionSelected(nsIPresContext* aPresContext,
                               PRInt32 aIndex,
                               PRBool aSelected);
@@ -309,10 +307,6 @@ public:
   NS_IMETHOD KeyUp(nsIDOMEvent* aKeyEvent)    { return NS_OK; }
   NS_IMETHOD KeyPress(nsIDOMEvent* aKeyEvent);
 
-  //nsIStatefulFrame
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
-
   // Static Methods
   static nsIDOMHTMLSelectElement* GetSelect(nsIContent * aContent);
   static nsIDOMHTMLCollection*    GetOptions(nsIContent * aContent, nsIDOMHTMLSelectElement* aSelect = nsnull);
diff --git a/mozilla/layout/html/base/src/nsFrameManager.cpp b/mozilla/layout/html/base/src/nsFrameManager.cpp
index 6722328e9a5..cfcb8f660e2 100644
--- a/mozilla/layout/html/base/src/nsFrameManager.cpp
+++ b/mozilla/layout/html/base/src/nsFrameManager.cpp
@@ -71,6 +71,7 @@
 #include "nsIContentList.h"
 #include "nsReadableUtils.h"
 #include "nsUnicharUtils.h"
+#include "nsPrintfCString.h"
 
   #ifdef DEBUG
     #undef NOISY_DEBUG
@@ -366,7 +367,7 @@ public:
                                nsIStatefulFrame::SpecialStateID aID = nsIStatefulFrame::eNoID);
   NS_IMETHOD GenerateStateKey(nsIContent* aContent,
                               nsIStatefulFrame::SpecialStateID aID,
-                              nsCString& aString);
+                              nsACString& aString);
 
   // Gets and sets properties on a given frame
   NS_IMETHOD GetFrameProperty(nsIFrame* aFrame,
@@ -2048,14 +2049,14 @@ FrameManager::RestoreFrameState(nsIPresContext* aPresContext, nsIFrame* aFrame,
 }
 
 
-static inline void KeyAppendSep(nsCString& aKey)
+static inline void KeyAppendSep(nsACString& aKey)
 {
   if (!aKey.IsEmpty()) {
-    aKey.Append(">");
+    aKey.Append('>');
   }
 }
 
-static inline void KeyAppendString(const nsAString& aString, nsCString& aKey)
+static inline void KeyAppendString(const nsAString& aString, nsACString& aKey)
 {
   KeyAppendSep(aKey);
 
@@ -2065,14 +2066,14 @@ static inline void KeyAppendString(const nsAString& aString, nsCString& aKey)
   aKey.Append(NS_ConvertUCS2toUTF8(aString));
 }
 
-static inline void KeyAppendInt(PRInt32 aInt, nsCString& aKey)
+static inline void KeyAppendInt(PRInt32 aInt, nsACString& aKey)
 {
   KeyAppendSep(aKey);
 
-  aKey.AppendInt(aInt);
+  aKey.Append(nsPrintfCString("%d", aInt));
 }
 
-static inline void KeyAppendAtom(nsIAtom* aAtom, nsCString& aKey)
+static inline void KeyAppendAtom(nsIAtom* aAtom, nsACString& aKey)
 {
   NS_PRECONDITION(aAtom, "KeyAppendAtom: aAtom can not be null!\n");
 
@@ -2093,7 +2094,7 @@ static inline PRBool IsAutocompleteOff(nsIDOMElement* aElement)
 NS_IMETHODIMP
 FrameManager::GenerateStateKey(nsIContent* aContent,
                                nsIStatefulFrame::SpecialStateID aID,
-                               nsCString& aKey)
+                               nsACString& aKey)
 {
   aKey.Truncate();
 
diff --git a/mozilla/layout/html/forms/public/nsISelectControlFrame.h b/mozilla/layout/html/forms/public/nsISelectControlFrame.h
index aa9a701b30a..8c840ada778 100644
--- a/mozilla/layout/html/forms/public/nsISelectControlFrame.h
+++ b/mozilla/layout/html/forms/public/nsISelectControlFrame.h
@@ -74,9 +74,10 @@ public:
   NS_IMETHOD GetOptionSelected(PRInt32 index, PRBool* value) = 0;
 
   /**
-   * Sets the select state of the option at index
+   * Sets whether the parser is done adding children
+   * @param aIsDone whether the parser is done adding children
    */
-  NS_IMETHOD DoneAddingContent(PRBool aIsDone) = 0;
+  NS_IMETHOD DoneAddingChildren(PRBool aIsDone) = 0;
 
   /**
    * Notify the frame when an option is selected
diff --git a/mozilla/layout/html/forms/src/nsComboboxControlFrame.cpp b/mozilla/layout/html/forms/src/nsComboboxControlFrame.cpp
index 080ac754819..564fb28ad4f 100644
--- a/mozilla/layout/html/forms/src/nsComboboxControlFrame.cpp
+++ b/mozilla/layout/html/forms/src/nsComboboxControlFrame.cpp
@@ -1872,7 +1872,6 @@ nsComboboxControlFrame::GetDropDown(nsIFrame** aDropDownFrame)
 NS_IMETHODIMP 
 nsComboboxControlFrame::ToggleList(nsIPresContext* aPresContext)
 {
-
   ShowList(aPresContext, (PR_FALSE == mDroppedDown));
 
   return NS_OK;
@@ -1996,7 +1995,7 @@ nsComboboxControlFrame::GetIndexOfDisplayArea(PRInt32* aSelectedIndex)
 // nsISelectControlFrame
 //----------------------------------------------------------------------
 NS_IMETHODIMP
-nsComboboxControlFrame::DoneAddingContent(PRBool aIsDone)
+nsComboboxControlFrame::DoneAddingChildren(PRBool aIsDone)
 {
   nsISelectControlFrame* listFrame = nsnull;
   nsresult rv = NS_ERROR_FAILURE;
@@ -2004,7 +2003,7 @@ nsComboboxControlFrame::DoneAddingContent(PRBool aIsDone)
     rv = mDropdownFrame->QueryInterface(NS_GET_IID(nsISelectControlFrame), 
                                                 (void**)&listFrame);
     if (NS_SUCCEEDED(rv) && listFrame) {
-      rv = listFrame->DoneAddingContent(aIsDone);
+      rv = listFrame->DoneAddingChildren(aIsDone);
       NS_RELEASE(listFrame);
     }
   }
@@ -2672,6 +2671,7 @@ nsComboboxControlFrame::SaveState(nsIPresContext* aPresContext,
                                   nsIPresState** aState)
 {
   nsCOMPtr<nsIStatefulFrame> stateful(do_QueryInterface(mListControlFrame));
+  NS_ASSERTION(stateful, "Couldn't cast list frame to stateful frame!!!");
   if (stateful) {
     return stateful->SaveState(aPresContext, aState);
   }
@@ -2689,6 +2689,5 @@ nsComboboxControlFrame::RestoreState(nsIPresContext* aPresContext,
   nsresult rv = CallQueryInterface(mListControlFrame, &stateful);
   NS_ASSERTION(NS_SUCCEEDED(rv), "Must implement nsIStatefulFrame");
   rv = stateful->RestoreState(aPresContext, aState);
-  InitTextStr();
   return rv;
 }
diff --git a/mozilla/layout/html/forms/src/nsComboboxControlFrame.h b/mozilla/layout/html/forms/src/nsComboboxControlFrame.h
index 6dad9aa76d6..cf286d7237c 100644
--- a/mozilla/layout/html/forms/src/nsComboboxControlFrame.h
+++ b/mozilla/layout/html/forms/src/nsComboboxControlFrame.h
@@ -188,7 +188,7 @@ public:
   NS_IMETHOD AddOption(nsIPresContext* aPresContext, PRInt32 index);
   NS_IMETHOD RemoveOption(nsIPresContext* aPresContext, PRInt32 index);
   NS_IMETHOD GetOptionSelected(PRInt32 aIndex, PRBool* aValue);
-  NS_IMETHOD DoneAddingContent(PRBool aIsDone);
+  NS_IMETHOD DoneAddingChildren(PRBool aIsDone);
   NS_IMETHOD OnOptionSelected(nsIPresContext* aPresContext,
                               PRInt32 aIndex,
                               PRBool aSelected);
diff --git a/mozilla/layout/html/forms/src/nsFileControlFrame.cpp b/mozilla/layout/html/forms/src/nsFileControlFrame.cpp
index df4cf0aaa5d..87911fd302d 100644
--- a/mozilla/layout/html/forms/src/nsFileControlFrame.cpp
+++ b/mozilla/layout/html/forms/src/nsFileControlFrame.cpp
@@ -63,7 +63,6 @@
 #include "nsIDOMMouseListener.h"
 #include "nsIPresShell.h"
 #include "nsIDOMHTMLInputElement.h"
-#include "nsIStatefulFrame.h"
 #include "nsISupportsPrimitives.h"
 #include "nsIComponentManager.h"
 #include "nsIDOMWindowInternal.h"
@@ -149,10 +148,16 @@ nsFileControlFrame::CreateAnonymousContent(nsIPresContext* aPresContext,
 
   if (NS_SUCCEEDED(rv)) {
     mTextContent->SetAttr(kNameSpaceID_None, nsHTMLAtoms::type, NS_LITERAL_STRING("text"), PR_FALSE);
-    if (nsFormFrame::GetDisabled(this)) {
-      nsCOMPtr<nsIDOMHTMLInputElement> textControl = do_QueryInterface(mTextContent);
-      if (textControl) {
-        textControl->SetDisabled(nsFormFrame::GetDisabled(this));
+    nsCOMPtr<nsIDOMHTMLInputElement> textControl = do_QueryInterface(mTextContent);
+    if (textControl) {
+      textControl->SetDisabled(nsFormFrame::GetDisabled(this));
+      // Initialize value when we create the content in case the value was set
+      // before we got here
+      nsCOMPtr<nsIDOMHTMLInputElement> fileContent = do_QueryInterface(mContent);
+      if (fileContent) {
+        nsAutoString value;
+        fileContent->GetValue(value);
+        textControl->SetValue(value);
       }
     }
     aChildList.AppendElement(mTextContent);
@@ -199,9 +204,6 @@ nsFileControlFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
   } else  if (aIID.Equals(NS_GET_IID(nsIDOMMouseListener))) {
     *aInstancePtr = (void*)(nsIDOMMouseListener*) this;
     return NS_OK;
-  } else  if (aIID.Equals(NS_GET_IID(nsIStatefulFrame))) {
-    *aInstancePtr = (void*)(nsIStatefulFrame*) this;
-    return NS_OK;
   }
   return nsHTMLContainerFrame::QueryInterface(aIID, aInstancePtr);
 }
@@ -678,54 +680,6 @@ nsFileControlFrame::Paint(nsIPresContext*      aPresContext,
   return nsFrame::Paint(aPresContext, aRenderingContext, aDirtyRect, aWhichLayer);
 }
 
-//----------------------------------------------------------------------
-// nsIStatefulFrame
-//----------------------------------------------------------------------
-NS_IMETHODIMP
-nsFileControlFrame::SaveState(nsIPresContext* aPresContext, nsIPresState** aState)
-{
-  NS_ENSURE_ARG_POINTER(aState);
-
-  // Don't save state before we are initialized
-  if (!mTextFrame && !mCachedState) {
-    return NS_OK;
-  }
-
-  // Get the value string
-  nsAutoString stateString;
-  nsresult res = GetProperty(nsHTMLAtoms::value, stateString);
-  NS_ENSURE_SUCCESS(res, res);
-
-  // Compare to default value, and only save if needed (Bug 62713)
-  nsAutoString defaultStateString;
-  nsCOMPtr<nsIDOMHTMLInputElement> formControl(do_QueryInterface(mContent));
-  if (formControl) {
-    formControl->GetDefaultValue(defaultStateString);
-  }
-
-  if (! stateString.Equals(defaultStateString)) {
-
-    // Construct a pres state and store value in it.
-    res = NS_NewPresState(aState);
-    NS_ENSURE_SUCCESS(res, res);
-    res = (*aState)->SetStateProperty(NS_LITERAL_STRING("value"), stateString);
-  }
-
-  return res;
-}
-
-NS_IMETHODIMP
-nsFileControlFrame::RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
-{
-  NS_ENSURE_ARG_POINTER(aState);
-
-  nsAutoString string;
-  aState->GetStateProperty(NS_LITERAL_STRING("value"), string);
-  SetProperty(aPresContext, nsHTMLAtoms::value, string);
-
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 nsFileControlFrame::OnContentReset()
 {
diff --git a/mozilla/layout/html/forms/src/nsFileControlFrame.h b/mozilla/layout/html/forms/src/nsFileControlFrame.h
index 7c21d161089..56bfd7833d3 100644
--- a/mozilla/layout/html/forms/src/nsFileControlFrame.h
+++ b/mozilla/layout/html/forms/src/nsFileControlFrame.h
@@ -42,7 +42,6 @@
 #include "nsIFormControlFrame.h"
 #include "nsIDOMMouseListener.h"
 #include "nsIAnonymousContentCreator.h"
-#include "nsIStatefulFrame.h"
 #include "nsCOMPtr.h"
 #include "nsIHTMLContent.h"
 
@@ -57,9 +56,7 @@ class nsISupportsArray;
 class nsFileControlFrame : public nsAreaFrame,
                            public nsIFormControlFrame,
                            public nsIDOMMouseListener,
-                           public nsIAnonymousContentCreator,
-                           public nsIStatefulFrame
-
+                           public nsIAnonymousContentCreator
 {
 public:
   nsFileControlFrame();
@@ -183,10 +180,6 @@ public:
 
   NS_IMETHOD HandleEvent(nsIDOMEvent* aEvent) { return NS_OK; }
 
-  //nsIStatefulFrame
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
-
 protected:
   virtual PRIntn GetSkipSides() const;
 
diff --git a/mozilla/layout/html/forms/src/nsFormControlHelper.cpp b/mozilla/layout/html/forms/src/nsFormControlHelper.cpp
index 763b8a94504..35a8406481a 100644
--- a/mozilla/layout/html/forms/src/nsFormControlHelper.cpp
+++ b/mozilla/layout/html/forms/src/nsFormControlHelper.cpp
@@ -892,37 +892,3 @@ nsFormControlHelper::Reset(nsIFrame* aFrame, nsIPresContext* aPresContext)
   return NS_ERROR_FAILURE;
 }
 
-nsresult
-nsFormControlHelper::SaveContentState(nsIFrame* aFrame,
-                                      nsIPresContext* aPresContext,
-                                      nsIPresState** aState)
-{
-  nsCOMPtr<nsIContent> controlContent;
-  aFrame->GetContent(getter_AddRefs(controlContent));
-
-  nsCOMPtr<nsIFormControl> control = do_QueryInterface(controlContent);
-  if (control) {
-    control->SaveState(aPresContext, aState);
-    return NS_OK;
-  }
-
-  return NS_ERROR_FAILURE;
-}
-
-nsresult
-nsFormControlHelper::RestoreContentState(nsIFrame* aFrame,
-                                         nsIPresContext* aPresContext,
-                                         nsIPresState* aState)
-{
-  nsCOMPtr<nsIContent> controlContent;
-  aFrame->GetContent(getter_AddRefs(controlContent));
-
-  nsCOMPtr<nsIFormControl> control = do_QueryInterface(controlContent);
-  if (control) {
-    control->RestoreState(aPresContext, aState);
-    return NS_OK;
-  }
-
-  NS_NOTREACHED("no content");
-  return NS_ERROR_FAILURE;
-}
diff --git a/mozilla/layout/html/forms/src/nsFormControlHelper.h b/mozilla/layout/html/forms/src/nsFormControlHelper.h
index f5f8bec6a40..cfe795743fc 100644
--- a/mozilla/layout/html/forms/src/nsFormControlHelper.h
+++ b/mozilla/layout/html/forms/src/nsFormControlHelper.h
@@ -160,12 +160,6 @@ public:
   static nsresult GetName(nsIContent* aContent, nsAString* aResult);
   static nsresult GetInputElementValue(nsIContent* aContent, nsString* aText, PRBool aInitialValue);
   static nsresult Reset(nsIFrame* aFrame, nsIPresContext* aPresContext);
-  static nsresult SaveContentState(nsIFrame* aFrame,
-                                   nsIPresContext* aPresContext,
-                                   nsIPresState** aState);
-  static nsresult RestoreContentState(nsIFrame* aFrame,
-                                      nsIPresContext* aPresContext,
-                                      nsIPresState* aState);
 
  /** 
   * Utility to convert a string to a PRBool
diff --git a/mozilla/layout/html/forms/src/nsGfxButtonControlFrame.cpp b/mozilla/layout/html/forms/src/nsGfxButtonControlFrame.cpp
index 562c2b824bc..0945f49b119 100644
--- a/mozilla/layout/html/forms/src/nsGfxButtonControlFrame.cpp
+++ b/mozilla/layout/html/forms/src/nsGfxButtonControlFrame.cpp
@@ -466,8 +466,6 @@ nsGfxButtonControlFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
 
   if (aIID.Equals(NS_GET_IID(nsIAnonymousContentCreator))) {
     *aInstancePtr = NS_STATIC_CAST(nsIAnonymousContentCreator*, this);
-  } else if (aIID.Equals(NS_GET_IID(nsIStatefulFrame))) {
-    *aInstancePtr = NS_STATIC_CAST(nsIStatefulFrame*, this);
   }
 else {
     return nsHTMLButtonControlFrame::QueryInterface(aIID, aInstancePtr);
@@ -651,48 +649,3 @@ nsGfxButtonControlFrame::HandleEvent(nsIPresContext* aPresContext,
   
   return NS_OK;
 }
-
-//----------------------------------------------------------------------
-// nsIStatefulFrame
-//----------------------------------------------------------------------
-NS_IMETHODIMP
-nsGfxButtonControlFrame::SaveState(nsIPresContext* aPresContext, nsIPresState** aState)
-{
-  NS_ENSURE_ARG_POINTER(aState);
-
-  // Get the value string
-  nsAutoString stateString;
-  nsresult res = GetProperty(nsHTMLAtoms::value, stateString);
-  NS_ENSURE_SUCCESS(res, res);
-
-  // Compare to default value, and only save if needed (Bug 62713)
-  NS_ENSURE_TRUE(mContent->IsContentOfType(nsIContent::eHTML_FORM_CONTROL),
-                 NS_ERROR_UNEXPECTED);
-  nsAutoString defaultStateString;
-  if (!mDefaultValueWasChanged) {
-    mContent->GetAttr(kNameSpaceID_None, nsHTMLAtoms::value, defaultStateString);
-  }
-
-  if (mDefaultValueWasChanged || !stateString.Equals(defaultStateString)) {
-
-    // Construct a pres state and store value in it.
-    res = NS_NewPresState(aState);
-    NS_ENSURE_SUCCESS(res, res);
-    res = (*aState)->SetStateProperty(NS_LITERAL_STRING("value"), stateString);
-  }
-
-  return res;
-}
-
-NS_IMETHODIMP
-nsGfxButtonControlFrame::RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
-{
-  NS_ENSURE_ARG_POINTER(aState);
-
-  // Set the value to the stored state.
-  nsAutoString stateString;
-  nsresult res = aState->GetStateProperty(NS_LITERAL_STRING("value"), stateString);
-  NS_ENSURE_SUCCESS(res, res);
-
-  return SetProperty(aPresContext, nsHTMLAtoms::value, stateString);
-}
diff --git a/mozilla/layout/html/forms/src/nsGfxButtonControlFrame.h b/mozilla/layout/html/forms/src/nsGfxButtonControlFrame.h
index cf88e5c95bc..2f0b32bf4bd 100644
--- a/mozilla/layout/html/forms/src/nsGfxButtonControlFrame.h
+++ b/mozilla/layout/html/forms/src/nsGfxButtonControlFrame.h
@@ -43,7 +43,6 @@
 #include "nsCOMPtr.h"
 #include "nsIAnonymousContentCreator.h"
 #include "nsITextContent.h"
-#include "nsIStatefulFrame.h"
 
 #ifdef ACCESSIBILITY
 class nsIAccessible;
@@ -57,8 +56,7 @@ class nsIAccessible;
 class nsIPresState;
 
 class nsGfxButtonControlFrame : public nsHTMLButtonControlFrame,
-                                public nsIAnonymousContentCreator,
-                                public nsIStatefulFrame
+                                public nsIAnonymousContentCreator
 {
 public:
   nsGfxButtonControlFrame();
@@ -117,10 +115,6 @@ protected:
   virtual PRBool IsSubmit(PRInt32 type);
   virtual PRBool IsBrowse(PRInt32 type); // Browse button of file input
 
-  //nsIStatefulFrame
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
-
 private:
   NS_IMETHOD_(nsrefcnt) AddRef() { return NS_OK; }
   NS_IMETHOD_(nsrefcnt) Release() { return NS_OK; }
diff --git a/mozilla/layout/html/forms/src/nsGfxCheckboxControlFrame.cpp b/mozilla/layout/html/forms/src/nsGfxCheckboxControlFrame.cpp
index a0de56439aa..86a36c4a4ba 100644
--- a/mozilla/layout/html/forms/src/nsGfxCheckboxControlFrame.cpp
+++ b/mozilla/layout/html/forms/src/nsGfxCheckboxControlFrame.cpp
@@ -96,10 +96,7 @@ nsGfxCheckboxControlFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr
   NS_ASSERTION(aInstancePtr, "QueryInterface requires a non-NULL destination!");
   if ( !aInstancePtr )
     return NS_ERROR_NULL_POINTER;
-  if (aIID.Equals(NS_GET_IID(nsIStatefulFrame))) {
-    *aInstancePtr = (void*)(nsIStatefulFrame*) this;
-    return NS_OK;
-  }
+
   if (aIID.Equals(NS_GET_IID(nsICheckboxControlFrame))) {
     *aInstancePtr = (void*) ((nsICheckboxControlFrame*) this);
     return NS_OK;
@@ -275,21 +272,6 @@ nsGfxCheckboxControlFrame::GetCheckboxState ( )
   return retval;
 }
 
-//----------------------------------------------------------------------
-// nsIStatefulFrame
-//----------------------------------------------------------------------
-NS_IMETHODIMP nsGfxCheckboxControlFrame::SaveState(nsIPresContext* aPresContext,
-                                                nsIPresState** aState)
-{
-  return nsFormControlHelper::SaveContentState(this, aPresContext, aState);
-}
-
-NS_IMETHODIMP nsGfxCheckboxControlFrame::RestoreState(nsIPresContext* aPresContext,
-                                                   nsIPresState* aState)
-{
-  return nsFormControlHelper::RestoreContentState(this, aPresContext, aState);
-}
-
 //------------------------------------------------------------
 // Extra Debug Methods
 //------------------------------------------------------------
diff --git a/mozilla/layout/html/forms/src/nsGfxCheckboxControlFrame.h b/mozilla/layout/html/forms/src/nsGfxCheckboxControlFrame.h
index 16549d7ddd0..80e8bd7a67e 100644
--- a/mozilla/layout/html/forms/src/nsGfxCheckboxControlFrame.h
+++ b/mozilla/layout/html/forms/src/nsGfxCheckboxControlFrame.h
@@ -38,7 +38,6 @@
 #define nsGfxCheckboxControlFrame_h___
 
 #include "nsFormControlFrame.h"
-#include "nsIStatefulFrame.h"
 #include "nsICheckboxControlFrame.h"
 
 #ifdef ACCESSIBILITY
@@ -50,7 +49,6 @@ class nsIAccessible;
 #define NS_GFX_CHECKBOX_CONTROL_FRAME_LAST_CONTEXT_INDEX   0
 
 class nsGfxCheckboxControlFrame : public nsFormControlFrame,
-                                  public nsIStatefulFrame,
                                   public nsICheckboxControlFrame//,
                                   //public nsIAccessible
 {
@@ -90,11 +88,7 @@ public:
     // nsIFormControlFrame
   NS_IMETHOD OnContentReset();
 
-   // nsIStatefulFrame
   NS_IMETHOD QueryInterface(const nsIID& aIID, void** aInstancePtr);
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
-
 
 #ifdef DEBUG_rodsXXX
   NS_IMETHOD Reflow(nsIPresContext*          aCX,
diff --git a/mozilla/layout/html/forms/src/nsGfxRadioControlFrame.cpp b/mozilla/layout/html/forms/src/nsGfxRadioControlFrame.cpp
index 5e0f9b7d33e..89f0ae2c598 100644
--- a/mozilla/layout/html/forms/src/nsGfxRadioControlFrame.cpp
+++ b/mozilla/layout/html/forms/src/nsGfxRadioControlFrame.cpp
@@ -94,10 +94,6 @@ nsGfxRadioControlFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
     *aInstancePtr = (void*) ((nsIRadioControlFrame*) this);
     return NS_OK;
   }
-  if (aIID.Equals(NS_GET_IID(nsIStatefulFrame))) {
-    *aInstancePtr = (void*) ((nsIStatefulFrame*) this);
-    return NS_OK;
-  }
 
   return nsFormControlFrame::QueryInterface(aIID, aInstancePtr);
 }
@@ -257,25 +253,6 @@ nsGfxRadioControlFrame::OnChecked(nsIPresContext* aPresContext,
   return NS_OK;
 }
 
-//----------------------------------------------------------------------
-// nsIStatefulFrame
-//----------------------------------------------------------------------
-NS_IMETHODIMP
-nsGfxRadioControlFrame::SaveState(nsIPresContext* aPresContext,
-                                  nsIPresState** aState)
-{
-  return nsFormControlHelper::SaveContentState(this, aPresContext, aState);
-}
-        
-
-
-//----------------------------------------------------------------------
-NS_IMETHODIMP
-nsGfxRadioControlFrame::RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
-{
-  return nsFormControlHelper::RestoreContentState(this, aPresContext, aState);
-}
-
 
 //----------------------------------------------------------------------
 // Extra Debug Helper Methods
diff --git a/mozilla/layout/html/forms/src/nsGfxRadioControlFrame.h b/mozilla/layout/html/forms/src/nsGfxRadioControlFrame.h
index 372fbc5d6a6..b04f5debf6d 100644
--- a/mozilla/layout/html/forms/src/nsGfxRadioControlFrame.h
+++ b/mozilla/layout/html/forms/src/nsGfxRadioControlFrame.h
@@ -39,7 +39,6 @@
 #define nsGfxRadioControlFrame_h___
 
 #include "nsFormControlFrame.h"
-#include "nsIStatefulFrame.h"
 #include "nsIRadioControlFrame.h"
 
 #ifdef ACCESSIBILITY
@@ -52,7 +51,6 @@ class nsIAccessible;
 #define NS_GFX_RADIO_CONTROL_FRAME_LAST_CONTEXT_INDEX   0
 
 class nsGfxRadioControlFrame : public nsFormControlFrame,
-                               public nsIStatefulFrame,
                                public nsIRadioControlFrame
 
 {
@@ -97,10 +95,6 @@ public:
   // nsIFormControlFrame
   NS_IMETHOD OnContentReset();
 
-  //nsIStatefulFrame
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
-
   ///XXX: End o the temporary methods
 #ifdef DEBUG_rodsXXX
   NS_IMETHOD Reflow(nsIPresContext*          aCX,
diff --git a/mozilla/layout/html/forms/src/nsGfxTextControlFrame2.cpp b/mozilla/layout/html/forms/src/nsGfxTextControlFrame2.cpp
index 5de5ca0c7fb..8ea4eeca24f 100644
--- a/mozilla/layout/html/forms/src/nsGfxTextControlFrame2.cpp
+++ b/mozilla/layout/html/forms/src/nsGfxTextControlFrame2.cpp
@@ -1329,10 +1329,6 @@ nsGfxTextControlFrame2::QueryInterface(const nsIID& aIID, void** aInstancePtr)
     *aInstancePtr = (void*)(nsIGfxTextControlFrame2*) this;
     return NS_OK;
   }
-  if (aIID.Equals(NS_GET_IID(nsIStatefulFrame))) {
-    *aInstancePtr = (void*)(nsIStatefulFrame*) this;
-    return NS_OK;
-  }
   if (aIID.Equals(NS_GET_IID(nsIScrollableViewProvider))) {
     *aInstancePtr = (void*)(nsIScrollableViewProvider*) this;
     return NS_OK;
@@ -3405,21 +3401,6 @@ nsGfxTextControlFrame2::GetWidthInCharacters() const
   return DEFAULT_COLUMN_WIDTH;
 }
 
-//----------------------------------------------------------------------
-// nsIStatefulFrame
-//----------------------------------------------------------------------
-NS_IMETHODIMP
-nsGfxTextControlFrame2::SaveState(nsIPresContext* aPresContext, nsIPresState** aState)
-{
-  return nsFormControlHelper::SaveContentState(this, aPresContext, aState);
-}
-
-NS_IMETHODIMP
-nsGfxTextControlFrame2::RestoreState(nsIPresContext* aPresContext, nsIPresState* aState)
-{
-  return nsFormControlHelper::RestoreContentState(this, aPresContext, aState);
-}
-
 NS_IMETHODIMP
 nsGfxTextControlFrame2::GetScrollableView(nsIScrollableView** aView)
 {
diff --git a/mozilla/layout/html/forms/src/nsGfxTextControlFrame2.h b/mozilla/layout/html/forms/src/nsGfxTextControlFrame2.h
index 57ab76c135b..22d50822390 100644
--- a/mozilla/layout/html/forms/src/nsGfxTextControlFrame2.h
+++ b/mozilla/layout/html/forms/src/nsGfxTextControlFrame2.h
@@ -43,7 +43,6 @@
 #include "nsIFormControlFrame.h"
 #include "nsIDOMMouseListener.h"
 #include "nsIAnonymousContentCreator.h"
-#include "nsIStatefulFrame.h"
 #include "nsIEditor.h"
 #include "nsIGfxTextControlFrame.h"
 #include "nsFormControlHelper.h"//for the inputdimensions
@@ -70,7 +69,6 @@ class nsIAccessible;
 class nsGfxTextControlFrame2 : public nsStackFrame,
                                public nsIAnonymousContentCreator,
                                public nsIGfxTextControlFrame2,
-                               public nsIStatefulFrame,
                                public nsIScrollableViewProvider
 
 {
@@ -231,10 +229,6 @@ protected:
 
   PRInt32 GetWidthInCharacters() const;
 
-  //nsIStatefulFrame
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
-
   // nsIScrollableViewProvider
   NS_IMETHOD GetScrollableView(nsIScrollableView** aView);
 
diff --git a/mozilla/layout/html/forms/src/nsListControlFrame.cpp b/mozilla/layout/html/forms/src/nsListControlFrame.cpp
index 96e0f9d82c4..0dcff1613f2 100644
--- a/mozilla/layout/html/forms/src/nsListControlFrame.cpp
+++ b/mozilla/layout/html/forms/src/nsListControlFrame.cpp
@@ -553,10 +553,6 @@ nsListControlFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
     *aInstancePtr = (void*)(nsIDOMKeyListener*) this;                                        
     return NS_OK;                                                        
   }
-  if (aIID.Equals(NS_GET_IID(nsIStatefulFrame))) {
-    *aInstancePtr = (void*)(nsIStatefulFrame*) this;
-    return NS_OK;
-  }
   return nsScrollFrame::QueryInterface(aIID, aInstancePtr);
 }
 
@@ -1453,7 +1449,7 @@ nsListControlFrame::SetInitialChildList(nsIPresContext* aPresContext,
   // First check to see if all the content has been added
   nsCOMPtr<nsISelectElement> element(do_QueryInterface(mContent));
   if (element) {
-    element->IsDoneAddingContent(&mIsAllContentHere);
+    element->IsDoneAddingChildren(&mIsAllContentHere);
     if (!mIsAllContentHere) {
       mIsAllFramesHere    = PR_FALSE;
       mHasBeenInitialized = PR_FALSE;
@@ -1969,7 +1965,7 @@ PRBool nsListControlFrame::CheckIfAllFramesHere()
 
 //-------------------------------------------------------------------
 NS_IMETHODIMP
-nsListControlFrame::DoneAddingContent(PRBool aIsDone)
+nsListControlFrame::DoneAddingChildren(PRBool aIsDone)
 {
   mIsAllContentHere = aIsDone;
   if (mIsAllContentHere) {
@@ -2003,7 +1999,7 @@ nsListControlFrame::AddOption(nsIPresContext* aPresContext, PRInt32 aIndex)
   if (!mIsAllContentHere) {
     nsCOMPtr<nsISelectElement> element(do_QueryInterface(mContent));
     if (element) {
-      element->IsDoneAddingContent(&mIsAllContentHere);
+      element->IsDoneAddingChildren(&mIsAllContentHere);
       if (!mIsAllContentHere) {
         mIsAllFramesHere    = PR_FALSE;
         mHasBeenInitialized = PR_FALSE;
@@ -2775,15 +2771,8 @@ nsListControlFrame::MouseDown(nsIDOMEvent* aMouseEvent)
       if (NS_SUCCEEDED(mPresContext->GetEventStateManager(getter_AddRefs(stateManager)))) {
         nsIFrame * frame;
         stateManager->GetEventTarget(&frame);
-        nsCOMPtr<nsIListControlFrame> listFrame(do_QueryInterface(frame));
-        if (listFrame) {
-          if (!IsClickingInCombobox(aMouseEvent)) {
-            return NS_OK;
-          }
-        } else {
-          if (!IsClickingInCombobox(aMouseEvent)) {
-            return NS_OK;
-          }
+        if (!IsClickingInCombobox(aMouseEvent)) {
+          return NS_OK;
         }
         // This will consume the focus event we get from the clicking on the dropdown
         //stateManager->ConsumeFocusEvents(PR_TRUE);
@@ -3575,21 +3564,3 @@ nsListControlFrame::ItemsHaveBeenRemoved(nsIPresContext * aPresContext)
     ResetList(aPresContext);
   }
 }
-
-
-//--------------------------------------------------------
-// nsIStatefulFrame
-//--------------------------------------------------------
-NS_IMETHODIMP
-nsListControlFrame::SaveState(nsIPresContext* aPresContext,
-                              nsIPresState** aState)
-{
-  return nsFormControlHelper::SaveContentState(this, aPresContext, aState);
-}
-
-NS_IMETHODIMP
-nsListControlFrame::RestoreState(nsIPresContext* aPresContext,
-                                 nsIPresState* aState)
-{
-  return nsFormControlHelper::RestoreContentState(this, aPresContext, aState);
-}
diff --git a/mozilla/layout/html/forms/src/nsListControlFrame.h b/mozilla/layout/html/forms/src/nsListControlFrame.h
index 95784d6707e..e6c93e4d526 100644
--- a/mozilla/layout/html/forms/src/nsListControlFrame.h
+++ b/mozilla/layout/html/forms/src/nsListControlFrame.h
@@ -58,7 +58,6 @@
 #include "nsIPresState.h"
 #include "nsCWeakReference.h"
 #include "nsIContent.h"
-#include "nsIStatefulFrame.h"
 
 class nsIDOMHTMLSelectElement;
 class nsIDOMHTMLCollection;
@@ -68,7 +67,6 @@ class nsIViewManager;
 class nsIPresContext;
 class nsVoidArray;
 class nsIScrollableView;
-class nsIStatefulFrame;
 
 class nsListControlFrame;
 class nsSelectUpdateTimer;
@@ -283,7 +281,7 @@ public:
   NS_IMETHOD AddOption(nsIPresContext* aPresContext, PRInt32 index);
   NS_IMETHOD RemoveOption(nsIPresContext* aPresContext, PRInt32 index);
   NS_IMETHOD GetOptionSelected(PRInt32 aIndex, PRBool* aValue);
-  NS_IMETHOD DoneAddingContent(PRBool aIsDone);
+  NS_IMETHOD DoneAddingChildren(PRBool aIsDone);
   NS_IMETHOD OnOptionSelected(nsIPresContext* aPresContext,
                               PRInt32 aIndex,
                               PRBool aSelected);
@@ -309,10 +307,6 @@ public:
   NS_IMETHOD KeyUp(nsIDOMEvent* aKeyEvent)    { return NS_OK; }
   NS_IMETHOD KeyPress(nsIDOMEvent* aKeyEvent);
 
-  //nsIStatefulFrame
-  NS_IMETHOD SaveState(nsIPresContext* aPresContext, nsIPresState** aState);
-  NS_IMETHOD RestoreState(nsIPresContext* aPresContext, nsIPresState* aState);
-
   // Static Methods
   static nsIDOMHTMLSelectElement* GetSelect(nsIContent * aContent);
   static nsIDOMHTMLCollection*    GetOptions(nsIContent * aContent, nsIDOMHTMLSelectElement* aSelect = nsnull);