diff --git a/mozilla/content/base/src/nsGenericElement.cpp b/mozilla/content/base/src/nsGenericElement.cpp
index de297ae1fdf..b69cb929477 100644
--- a/mozilla/content/base/src/nsGenericElement.cpp
+++ b/mozilla/content/base/src/nsGenericElement.cpp
@@ -570,16 +570,20 @@ nsGenericElement::~nsGenericElement()
     if (mDOMSlots->mChildNodes) {
       mDOMSlots->mChildNodes->DropReference();
       NS_RELEASE(mDOMSlots->mChildNodes);
-      delete mDOMSlots->mRangeList;
     }
+
+    delete mDOMSlots->mRangeList;
+
     if (mDOMSlots->mStyle) {
       mDOMSlots->mStyle->DropReference();
       NS_RELEASE(mDOMSlots->mStyle);
     }
+
     if (mDOMSlots->mAttributeMap) {
       mDOMSlots->mAttributeMap->DropReference();
       NS_RELEASE(mDOMSlots->mAttributeMap);
     }
+
     if (mDOMSlots->mListenerManager) {
       mDOMSlots->mListenerManager->SetListenerTarget(nsnull);
       NS_RELEASE(mDOMSlots->mListenerManager);
@@ -2560,13 +2564,6 @@ nsGenericElement::QueryInterface(REFNSIID aIID, void** aInstancePtr)
     inst = NS_STATIC_CAST(nsIDOMEventReceiver *,
                           nsDOMEventRTTearoff::Create(this));
     NS_ENSURE_TRUE(inst, NS_ERROR_OUT_OF_MEMORY);
-  } else if (mDocument) {
-    nsCOMPtr<nsIBindingManager> manager;
-    mDocument->GetBindingManager(getter_AddRefs(manager));
-    if (manager)
-      return manager->GetBindingImplementation(this, aIID, aInstancePtr);
-
-    return NS_NOINTERFACE;
   } else {
     return NS_NOINTERFACE;
   }
@@ -2581,6 +2578,19 @@ nsGenericElement::QueryInterface(REFNSIID aIID, void** aInstancePtr)
 NS_IMPL_ADDREF(nsGenericElement)
 NS_IMPL_RELEASE(nsGenericElement)
 
+nsresult
+nsGenericElement::PostQueryInterface(REFNSIID aIID, void** aInstancePtr)
+{
+  if (mDocument) {
+    nsCOMPtr<nsIBindingManager> manager;
+    mDocument->GetBindingManager(getter_AddRefs(manager));
+    if (manager)
+      return manager->GetBindingImplementation(this, aIID, aInstancePtr);
+  }
+
+  return NS_NOINTERFACE;
+}
+
 //----------------------------------------------------------------------
 
 nsresult
diff --git a/mozilla/content/base/src/nsGenericElement.h b/mozilla/content/base/src/nsGenericElement.h
index 179ed5698f4..893f5909128 100644
--- a/mozilla/content/base/src/nsGenericElement.h
+++ b/mozilla/content/base/src/nsGenericElement.h
@@ -185,6 +185,10 @@ public:
 
   nsresult Init(nsINodeInfo *aNodeInfo);
 
+  // If QI fails on an element, call this method to let the binding
+  // manager have a chance...
+  nsresult PostQueryInterface(REFNSIID aIID, void** aInstancePtr);
+
   // Free globals, to be called from module destructor
   static void Shutdown();
 
diff --git a/mozilla/content/html/content/src/nsGenericHTMLElement.h b/mozilla/content/html/content/src/nsGenericHTMLElement.h
index c26e58ff0f1..bfc38e0e1d3 100644
--- a/mozilla/content/html/content/src/nsGenericHTMLElement.h
+++ b/mozilla/content/html/content/src/nsGenericHTMLElement.h
@@ -783,7 +783,7 @@ protected:
 
 #define NS_HTML_CONTENT_INTERFACE_MAP_END                                     \
     {                                                                         \
-      return NS_NOINTERFACE;                                                  \
+      return PostQueryInterface(aIID, aInstancePtr);                          \
     }                                                                         \
                                                                               \
     NS_ADDREF(foundInterface);                                                \
diff --git a/mozilla/content/xml/content/src/nsXMLElement.cpp b/mozilla/content/xml/content/src/nsXMLElement.cpp
index dbc43a5bbbe..dd4a8f04537 100644
--- a/mozilla/content/xml/content/src/nsXMLElement.cpp
+++ b/mozilla/content/xml/content/src/nsXMLElement.cpp
@@ -154,7 +154,7 @@ nsXMLElement::QueryInterface(REFNSIID aIID, void** aInstancePtr)
     inst = nsContentUtils::GetClassInfoInstance(eDOMClassInfo_Element_id);
     NS_ENSURE_TRUE(inst, NS_ERROR_OUT_OF_MEMORY);
   } else {
-    return NS_NOINTERFACE;
+    return PostQueryInterface(aIID, aInstancePtr);
   }
 
   NS_ADDREF(inst);