diff --git a/mozilla/content/base/src/nsXMLHttpRequest.cpp b/mozilla/content/base/src/nsXMLHttpRequest.cpp
index ca33dd55a35..c060471e602 100644
--- a/mozilla/content/base/src/nsXMLHttpRequest.cpp
+++ b/mozilla/content/base/src/nsXMLHttpRequest.cpp
@@ -1686,7 +1686,6 @@ nsXMLHttpRequest::Send(nsIVariant *aBody)
   mChannel->SetContentType(NS_LITERAL_CSTRING("application/xml"));
 
   // Start reading from the channel
-  ChangeState(XML_HTTP_REQUEST_SENT);
   rv = mChannel->AsyncOpen(listener, nsnull);
 
   if (NS_FAILED(rv)) {
@@ -1695,6 +1694,12 @@ nsXMLHttpRequest::Send(nsIVariant *aBody)
     return rv;
   }
 
+  // Now that we've successfully opened the channel, we can change state.  Note
+  // that this needs to come after the AsyncOpen() and rv check, because this
+  // can run script that would try to restart this request, and that could end
+  // up doing our AsyncOpen on a null channel if the reentered AsyncOpen fails.
+  ChangeState(XML_HTTP_REQUEST_SENT);
+
   // If we're synchronous, spin an event loop here and wait
   if (!(mState & XML_HTTP_REQUEST_ASYNC)) {
     nsIThread *thread = NS_GetCurrentThread();