diff --git a/mozilla/content/html/content/src/nsGenericHTMLElement.cpp b/mozilla/content/html/content/src/nsGenericHTMLElement.cpp
index bb76f1eb8b2..fe359611c75 100644
--- a/mozilla/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/mozilla/content/html/content/src/nsGenericHTMLElement.cpp
@@ -692,6 +692,7 @@ nsGenericHTMLElement::GetScriptObjectFactory(nsIDOMScriptObjectFactory **aResult
   }
 
   *aResult = gScriptObjectFactory;
+  NS_ADDREF(gScriptObjectFactory);
   return result;
 }
 
@@ -1046,7 +1047,7 @@ nsGenericHTMLElement::SetDocument(nsIDocument* aDocument)
   // Once the element is added to the doc tree we need to check if
   // event handler were registered on it.  Unfortunately, this means
   // doing a GetAttribute for every type of handler.
-  if (nsnull != mAttributes) {
+  if ((nsnull != mDocument) && (nsnull != mAttributes)) {
     nsHTMLValue val;
     if (NS_CONTENT_ATTR_HAS_VALUE == mAttributes->GetAttribute(nsHTMLAtoms::onclick, val))
       AddScriptEventListener(nsHTMLAtoms::onclick, val, kIDOMMouseListenerIID);
@@ -1803,6 +1804,7 @@ nsGenericHTMLElement::GetScriptObject(nsIScriptContext* aContext,
     mTag->ToString(tag);
     res = factory->NewScriptElement(tag, aContext, mContent,
                                     mParent, (void**)&mScriptObject);
+    NS_RELEASE(factory);
   }
   *aScriptObject = mScriptObject;
   return res;
diff --git a/mozilla/layout/html/content/src/nsGenericDOMDataNode.cpp b/mozilla/layout/html/content/src/nsGenericDOMDataNode.cpp
index 1524ea8a0dd..2baac2eaca0 100644
--- a/mozilla/layout/html/content/src/nsGenericDOMDataNode.cpp
+++ b/mozilla/layout/html/content/src/nsGenericDOMDataNode.cpp
@@ -17,6 +17,7 @@
  * Netscape Communications Corporation.  All Rights Reserved.
  */
 #include "nsGenericDOMDataNode.h"
+#include "nsGenericHTMLElement.h"
 #include "nsIEventListenerManager.h"
 #include "nsIDocument.h"
 #include "nsXIFConverter.h"
@@ -27,6 +28,7 @@
 #include "nsIPrivateDOMEvent.h"
 #include "nsISizeOfHandler.h"
 #include "nsDOMEvent.h"
+#include "nsIDOMScriptObjectFactory.h"
 
 // XXX share all id's in this dir
 
@@ -399,15 +401,19 @@ nsGenericDOMDataNode::GetScriptObject(nsIScriptContext* aContext,
                                       void** aScriptObject)
 {
   nsresult res = NS_OK;
-#if XXX
   if (nsnull == mScriptObject) {
-    nsIDOMElement* ele = nsnull;
-    mContent->QueryInterface(kIDOMElementIID, (void**) &ele);
-    res = NS_NewScriptElement(aContext, ele, mParent, (void**)&mScriptObject);
-    NS_RELEASE(ele);
+    nsIDOMScriptObjectFactory *factory;
+    
+    res = nsGenericHTMLElement::GetScriptObjectFactory(&factory);
+    if (NS_OK != res) {
+      return res;
+    }
+    
+    res = factory->NewScriptData(nsIDOMNode::TEXT, aContext, mContent,
+                                 mParent, (void**)&mScriptObject);
+    NS_RELEASE(factory);
   }
   *aScriptObject = mScriptObject;
-#endif
   return res;
 }
 
diff --git a/mozilla/layout/html/content/src/nsGenericHTMLElement.cpp b/mozilla/layout/html/content/src/nsGenericHTMLElement.cpp
index bb76f1eb8b2..fe359611c75 100644
--- a/mozilla/layout/html/content/src/nsGenericHTMLElement.cpp
+++ b/mozilla/layout/html/content/src/nsGenericHTMLElement.cpp
@@ -692,6 +692,7 @@ nsGenericHTMLElement::GetScriptObjectFactory(nsIDOMScriptObjectFactory **aResult
   }
 
   *aResult = gScriptObjectFactory;
+  NS_ADDREF(gScriptObjectFactory);
   return result;
 }
 
@@ -1046,7 +1047,7 @@ nsGenericHTMLElement::SetDocument(nsIDocument* aDocument)
   // Once the element is added to the doc tree we need to check if
   // event handler were registered on it.  Unfortunately, this means
   // doing a GetAttribute for every type of handler.
-  if (nsnull != mAttributes) {
+  if ((nsnull != mDocument) && (nsnull != mAttributes)) {
     nsHTMLValue val;
     if (NS_CONTENT_ATTR_HAS_VALUE == mAttributes->GetAttribute(nsHTMLAtoms::onclick, val))
       AddScriptEventListener(nsHTMLAtoms::onclick, val, kIDOMMouseListenerIID);
@@ -1803,6 +1804,7 @@ nsGenericHTMLElement::GetScriptObject(nsIScriptContext* aContext,
     mTag->ToString(tag);
     res = factory->NewScriptElement(tag, aContext, mContent,
                                     mParent, (void**)&mScriptObject);
+    NS_RELEASE(factory);
   }
   *aScriptObject = mScriptObject;
   return res;
diff --git a/mozilla/layout/html/tests/Rotate.html b/mozilla/layout/html/tests/Rotate.html
index 164492127bf..3cbd9c26983 100644
--- a/mozilla/layout/html/tests/Rotate.html
+++ b/mozilla/layout/html/tests/Rotate.html
@@ -24,5 +24,41 @@ And now a lot more text. And now a lot more text. And now a lot more text.
 And now a lot more text. And now a lot more text. And now a lot more text. 
 And now a lot more text. And now a lot more text. And now a lot more text. 
 </P>
+<SCRIPT>
+var body = document.documentElement.childNodes[1];
+var para = body.childNodes[1];
+var img1 = para.childNodes[5];
+var tbody = document.getElementsByTagName("TBODY")[0];
+var tparent = tbody.childNodes[0].childNodes[0];
+var img2 = tparent.childNodes[0].childNodes[0];
+
+var pos = 0;
+
+function rotate(p, c) {
+    p.removeChild(c);
+    var child = p.childNodes[pos++];
+    if (pos > p.childNodes.length) {
+      pos = 0;
+    }  
+    p.insertBefore(c, child);
+}
+
+function rotate2() {
+  tparent.childNodes[0].removeChild(img2);
+  if (tparent.nextSibling != null) {
+    tparent = tparent.nextSibling;
+  }
+  else if (tparent.parentNode.nextSibling != null) {
+    tparent = tparent.parentNode.nextSibling.childNodes[0];
+  }
+  else {
+    tparent = tbody.childNodes[0].childNodes[0];
+  }
+  tparent.childNodes[0].insertBefore(img2, tparent.childNodes[0].childNodes[0]);
+}
+var int1 = setInterval(rotate, 1000, para, img1);
+//var int2 = setInterval(rotate2, 1000)
+
+</SCRIPT>
 </BODY>
 </HTML>
\ No newline at end of file