diff --git a/mozilla/htmlparser/src/CNavDTD.cpp b/mozilla/htmlparser/src/CNavDTD.cpp
index 91535a08480..7f95a4a3327 100644
--- a/mozilla/htmlparser/src/CNavDTD.cpp
+++ b/mozilla/htmlparser/src/CNavDTD.cpp
@@ -87,9 +87,6 @@ static char gShowCRC;
 #  define START_TIMER()
 #endif
 
-
-
-
 /************************************************************************
   And now for the main class -- CNavDTD...
  ************************************************************************/
@@ -159,6 +156,7 @@ CNavDTD::CNavDTD() : nsIDTD(), mMisplacedContent(0), mSkippedContent(0), mShared
   mStyleHandlingEnabled=PR_TRUE;
   mIsText=PR_FALSE;
   mRequestedHead=PR_FALSE;
+  mIsFormContainer=PR_FALSE;
 
   if(!gHTMLElements) {
     InitializeElementTable();
@@ -1371,11 +1369,6 @@ nsresult CNavDTD::HandleStartToken(CToken* aToken) {
           aToken->SetTypeID(theChildTag=eHTMLTag_img);
           break;
 
-        //case eHTMLTag_userdefined:
-        case eHTMLTag_noscript:     //HACK XXX! Throw noscript on the floor for now.
-          isTokenHandled=PR_TRUE;
-          break;
-
         case eHTMLTag_script:
           theHeadIsParent=((!mHasOpenBody) || mRequestedHead);
           mHasOpenScript=PR_TRUE;
@@ -1387,7 +1380,17 @@ nsresult CNavDTD::HandleStartToken(CToken* aToken) {
       if(!isTokenHandled) {
         if(theHeadIsParent || 
            (mHasOpenHead && ((eHTMLTag_newline==theChildTag) || (eHTMLTag_whitespace==theChildTag)))) {
-              result=AddHeadLeaf(theNode);
+          //Ref. Bug 21008 -- Creating model for NOSCRIPT content
+          static eHTMLTags gNoXTags[]={eHTMLTag_noembed,eHTMLTag_noframes,eHTMLTag_nolayer,eHTMLTag_noscript};
+          if(FindTagInSet(theChildTag,gNoXTags,sizeof(gNoXTags)/sizeof(theChildTag))) {
+             result=OpenContainer(theNode,theChildTag,PR_TRUE);
+          }
+          else if(HasOpenContainer(gNoXTags,sizeof(gNoXTags)/sizeof(eHTMLTag_unknown))) {
+            result=AddLeaf(theNode);   
+          }
+          else {
+            result=AddHeadLeaf(theNode);
+          }
         }
         else result=HandleDefaultStartToken(aToken,theChildTag,theNode); 
       }
@@ -1665,6 +1668,13 @@ nsresult CNavDTD::HandleSavedTokens(PRInt32 anIndex) {
         PRInt32   theTopIndex = anIndex + 1;
         PRInt32   theTagCount = mBodyContext->GetCount();
         eHTMLTags theParentTag= mBodyContext->TagAt(anIndex);
+               
+        //XXX  In the content sink, FORM behaves as a container for parents 
+        //other than eHTMLTag_table,eHTMLTag_tbody,eHTMLTag_tr,eHTMLTag_col,
+        //eHTMLTag_tfoot,eHTMLTag_thead,eHTMLTag_colgroup.In those cases the stack 
+        //position, in the parser, should be synchronized with the sink. -- Ref: Bug 20087.
+
+        if(mHasOpenForm && mIsFormContainer) anIndex++;
 
         STOP_TIMER()
         MOZ_TIMER_DEBUGLOG(("Stop: Parse Time: CNavDTD::HandleSavedTokensAbove(), this=%p\n", this));     
@@ -1681,6 +1691,7 @@ nsresult CNavDTD::HandleSavedTokens(PRInt32 anIndex) {
           mTempContext->Push((nsCParserNode*)mBodyContext->Pop(theChildStyleStack));
         }
      
+        PRInt32 theIndex;
         // Now flush out all the bad contents.
         while(theBadTokenCount > 0){
           theToken=(CToken*)mMisplacedContent.PopFront();
@@ -1694,9 +1705,12 @@ nsresult CNavDTD::HandleSavedTokens(PRInt32 anIndex) {
                 mTokenizer->PushTokenFront(theAttrToken);
               }
             }
+            
             // Make sure that the BeginContext() is ended only by the call to
-            // EndContext(). 
-            if(theTag!=theParentTag || eToken_end!=theToken->GetTokenType())
+            // EndContext(). Ref: Bug 25202
+            if(eToken_end==theToken->GetTokenType()) theIndex=mBodyContext->LastOf(theTag);
+              
+            if(!(theIndex!=kNotFound && theIndex<=mBodyContext->mContextTopIndex))
               result=HandleToken(theToken,mParser);
             else mTokenRecycler->RecycleToken(theToken);
           }
@@ -2187,7 +2201,10 @@ PRBool CNavDTD::CanOmit(eHTMLTags aParent,eHTMLTags aChild,PRBool& aParentContai
       }
     }
     else if (!aParentContains) {
-      return PR_TRUE;
+      if(!gHTMLElements[aChild].HasSpecialProperty(kBadContentWatch)) {
+        return PR_TRUE; 
+      }
+      return PR_FALSE; // Ref. Bug 25658
     }
   }
 
@@ -2643,8 +2660,12 @@ nsresult CNavDTD::CloseBody(const nsIParserNode *aNode){
  * @return  TRUE if ok, FALSE if error
  */
 nsresult CNavDTD::OpenForm(const nsIParserNode *aNode){
+  static eHTMLTags gTableElements[]={eHTMLTag_table,eHTMLTag_tbody,eHTMLTag_tr,eHTMLTag_col,
+                                       eHTMLTag_tfoot,eHTMLTag_thead,eHTMLTag_colgroup};
   if(mHasOpenForm)
     CloseForm(aNode);
+    
+  mIsFormContainer=!(FindTagInSet(mBodyContext->Last(),gTableElements,sizeof(gTableElements)/sizeof(eHTMLTag_unknown)));
 
   STOP_TIMER();
   MOZ_TIMER_DEBUGLOG(("Stop: Parse Time: CNavDTD::OpenForm(), this=%p\n", this));
@@ -2680,6 +2701,9 @@ nsresult CNavDTD::CloseForm(const nsIParserNode *aNode){
 
     MOZ_TIMER_DEBUGLOG(("Start: Parse Time: CNavDTD::CloseForm(), this=%p\n", this));
     START_TIMER();
+        
+    if(mIsFormContainer)
+      mIsFormContainer=PR_FALSE;
 
   }
   return result;
@@ -3283,17 +3307,8 @@ nsresult CNavDTD::AddLeaf(const nsIParserNode *aNode){
 nsresult CNavDTD::AddHeadLeaf(nsIParserNode *aNode){
   nsresult result=NS_OK;
 
-  static eHTMLTags gNoXTags[]={eHTMLTag_noembed,eHTMLTag_noframes,eHTMLTag_nolayer,eHTMLTag_noscript};
-  
-  //this code has been added to prevent <meta> tags from being processed inside
-  //the document if the <meta> tag itself was found in a <noframe>, <nolayer>, or <noscript> tag.
   eHTMLTags theTag=(eHTMLTags)aNode->GetNodeType();
 
-  if(eHTMLTag_meta==theTag)
-    if(HasOpenContainer(gNoXTags,sizeof(gNoXTags)/sizeof(eHTMLTag_unknown))) {
-      return result;
-    }
-
   if(mSink) {
     result=OpenHead(aNode);
     if(NS_OK==result) {
diff --git a/mozilla/htmlparser/src/CNavDTD.h b/mozilla/htmlparser/src/CNavDTD.h
index 0645fd2f980..a8631e4e470 100644
--- a/mozilla/htmlparser/src/CNavDTD.h
+++ b/mozilla/htmlparser/src/CNavDTD.h
@@ -526,6 +526,7 @@ protected:
     PRBool              mStyleHandlingEnabled;
     PRBool              mIsText;
     PRBool              mRequestedHead;
+    PRBool              mIsFormContainer;
 
 #ifdef NS_DEBUG
     PRInt32 gNodeCount;
diff --git a/mozilla/htmlparser/src/nsElementTable.cpp b/mozilla/htmlparser/src/nsElementTable.cpp
index 4e704115efa..95b33ee69f3 100644
--- a/mozilla/htmlparser/src/nsElementTable.cpp
+++ b/mozilla/htmlparser/src/nsElementTable.cpp
@@ -49,7 +49,9 @@ TagList  gInTR={1,{eHTMLTag_tr}};
 TagList  gInDL={2,{eHTMLTag_dl,eHTMLTag_body}};
 TagList  gInFrameset={1,{eHTMLTag_frameset}};
 TagList  gInNoframes={1,{eHTMLTag_noframes}};
-TagList  gInP={3,{eHTMLTag_address,eHTMLTag_span,eHTMLTag_form}}; // P used to contain TABLE - Ref: Bug# 11229 - Removed TABLE to solve Bug# 24673
+// P used to contain TABLE [Ref: Bug# 11229], and ADDRESS.
+// Removed TABLE to solve Bug# 24673. Removed ADDRESS to solve 24885
+TagList  gInP={2,{eHTMLTag_span,eHTMLTag_form}}; 
 TagList  gOptgroupParents={2,{eHTMLTag_select,eHTMLTag_optgroup}};
 TagList  gBodyParents={2,{eHTMLTag_html,eHTMLTag_noframes}};
 TagList  gColParents={2,{eHTMLTag_table,eHTMLTag_colgroup}};
@@ -88,13 +90,13 @@ TagList  gLIKids={2,{eHTMLTag_ol,eHTMLTag_ul}};
 TagList  gMapKids={1,{eHTMLTag_area}};
 TagList  gPreKids={2,{eHTMLTag_hr,eHTMLTag_center}};  //note that CENTER is here for backward compatibility; it's not 4.0 spec.
 
-TagList  gTableKids={10,{eHTMLTag_caption,eHTMLTag_col,eHTMLTag_colgroup,eHTMLTag_form,
+TagList  gTableKids={9,{eHTMLTag_caption,eHTMLTag_col,eHTMLTag_colgroup,eHTMLTag_form,
                      eHTMLTag_thead,eHTMLTag_tbody,eHTMLTag_tfoot,
-                     eHTMLTag_map,eHTMLTag_script,eHTMLTag_input}};
+                     eHTMLTag_map,eHTMLTag_script}};// Removed INPUT - Ref. Bug 20087, 25382
   
 TagList  gTableElemKids={7,{eHTMLTag_form,eHTMLTag_map,eHTMLTag_noscript,eHTMLTag_script,eHTMLTag_td,eHTMLTag_th,eHTMLTag_tr}};
-TagList  gTRKids={6,{eHTMLTag_td,eHTMLTag_th,eHTMLTag_map,eHTMLTag_form,eHTMLTag_script,eHTMLTag_input}};
-TagList  gTBodyKids={3,{eHTMLTag_tr,eHTMLTag_form,eHTMLTag_input}};
+TagList  gTRKids={5,{eHTMLTag_td,eHTMLTag_th,eHTMLTag_map,eHTMLTag_form,eHTMLTag_script}};// Removed INPUT - Ref. Bug 20087, 25382
+TagList  gTBodyKids={2,{eHTMLTag_tr,eHTMLTag_form}}; // Removed INPUT - Ref. Bug 20087, 25382
 TagList  gULKids={2,{eHTMLTag_li,eHTMLTag_p}};
 
 
@@ -134,6 +136,8 @@ TagList  gDTCloseTags={3,{eHTMLTag_dt,eHTMLTag_dd,eHTMLTag_p}};
 TagList  gULCloseTags={1,{eHTMLTag_li}};
 
 
+TagList  gBlockQuoteExcludableParents={1,{eHTMLTag_pre}}; // Ref Bug 22913
+
 //*********************************************************************************************
 //Lastly, bind tags with their rules, their special parents and special kids.
 //*********************************************************************************************
@@ -160,7 +164,7 @@ void Initialize(eHTMLTags aTag,
                 TagList*  aAutocloseStart,    
                 TagList*  aAutocloseEnd,      
                 TagList*  aSynonymousTags,    
-                TagList*  aAutoCloseBlockers,  
+                TagList*  aExcludableParents,  
                 int       aParentBits,        
                 int       aInclusionBits, 
                 int       aExclusionBits,     
@@ -179,7 +183,7 @@ void Initialize(eHTMLTags aTag,
   gHTMLElements[aTag].mAutocloseStart=aAutocloseStart;
   gHTMLElements[aTag].mAutocloseEnd=aAutocloseEnd;
   gHTMLElements[aTag].mSynonymousTags=aSynonymousTags;
-  gHTMLElements[aTag].mAutoCloseBlockers=aAutoCloseBlockers;
+  gHTMLElements[aTag].mExcludableParents=aExcludableParents;
   gHTMLElements[aTag].mParentBits=aParentBits;
   gHTMLElements[aTag].mInclusionBits=aInclusionBits;
   gHTMLElements[aTag].mExclusionBits=aExclusionBits;
@@ -331,7 +335,7 @@ void InitializeElementTable(void) {
       /*tag*/                             eHTMLTag_blockquote,
       /*req-parent excl-parent*/          eHTMLTag_unknown,eHTMLTag_unknown,
 	    /*rootnodes,endrootnodes*/          &gRootTags,&gRootTags,	
-      /*autoclose starttags and endtags*/ 0,0,0,0,
+      /*autoclose starttags and endtags*/ 0,0,0,&gBlockQuoteExcludableParents,
       /*parent,incl,exclgroups*/          kBlock, (kSelf|kFlowEntity), kNone,	
       /*special props, prop-range*/       0,kDefaultPropRange,
       /*special parents,kids,skip*/       0,0,eHTMLTag_unknown);
@@ -857,7 +861,7 @@ void InitializeElementTable(void) {
       /*autoclose starttags and endtags*/ 0,0,0,0,
       /*parent,incl,exclgroups*/          kBlock, kFlowEntity|kSelf, kNone,	
       /*special props, prop-range*/       0, kNoPropRange,
-      /*special parents,kids,skip*/       0,0,eHTMLTag_noscript);
+      /*special parents,kids,skip*/       0,0,eHTMLTag_unknown);
 
     Initialize( 
       /*tag*/                             eHTMLTag_object,
@@ -874,7 +878,7 @@ void InitializeElementTable(void) {
 	    /*rootnodes,endrootnodes*/          &gOLRootTags,&gOLRootTags,	
       /*autoclose starttags and endtags*/ &gOLAutoClose, &gULCloseTags, 0,0,
       /*parent,incl,exclgroups*/          kList, (kFlowEntity|kSelf), kNone,	
-      /*special props, prop-range*/       0,kDefaultPropRange,
+      /*special props, prop-range*/       0,kDefaultPropRange,   
       /*special parents,kids,skip*/       0,&gULKids,eHTMLTag_unknown);
 
     Initialize( 
@@ -1009,8 +1013,8 @@ void InitializeElementTable(void) {
       /*req-parent excl-parent*/          eHTMLTag_unknown,eHTMLTag_unknown,
 	    /*rootnodes,endrootnodes*/          &gRootTags,&gRootTags,	
       /*autoclose starttags and endtags*/ 0,0,0,0,
-      /*parent,incl,exclgroups*/          kNone, kNone, kNone,	
-      /*special props, prop-range*/       0,kDefaultPropRange,
+      /*parent,incl,exclgroups*/          (kFlowEntity|kHeadContent), kNone, kNone,	 // Added kFlowEntity|kHeadContent & kNonContainer in
+      /*special props, prop-range*/       kNonContainer,kDefaultPropRange,           // Ref. to Bug 25749
       /*special parents,kids,skip*/       0,0,eHTMLTag_unknown);
 
     Initialize( 
@@ -1443,7 +1447,6 @@ PRBool nsHTMLElement::IsBlockParent(eHTMLTags aTag){
   return result;
 }
 
-
 /**
  * 
  * @update	gess 01/04/99
@@ -1861,6 +1864,11 @@ PRBool nsHTMLElement::CanContain(eHTMLTags aChild) const{
         return PR_FALSE;
     }
 
+    if(gHTMLElements[aChild].mExcludableParents) {
+      TagList* theParents=gHTMLElements[aChild].mExcludableParents;
+      if(FindTagInSet(mTagID,theParents->mTags,theParents->mCount))
+        return PR_FALSE;
+    }
 
     if(gHTMLElements[aChild].IsBlockCloser(aChild)){
       if(nsHTMLElement::IsBlockParent(mTagID)){
diff --git a/mozilla/htmlparser/src/nsElementTable.h b/mozilla/htmlparser/src/nsElementTable.h
index eb7709c57f3..da082093f68 100644
--- a/mozilla/htmlparser/src/nsElementTable.h
+++ b/mozilla/htmlparser/src/nsElementTable.h
@@ -194,7 +194,7 @@ struct nsHTMLElement {
   TagList*        mAutocloseStart;    //these are the start tags that you can automatically close with this START tag
   TagList*        mAutocloseEnd;      //these are the start tags that you can automatically close with this END tag
   TagList*        mSynonymousTags;    //These are morally equivalent; an end tag for one can close a start tag for another (like <Hn>)
-  TagList*        mAutoCloseBlockers; //...
+  TagList*        mExcludableParents; //These are the TAGS that cannot contain you
   int             mParentBits;        //defines groups that can contain this element
   int             mInclusionBits;     //defines parental and containment rules
   int             mExclusionBits;     //defines things you CANNOT contain
diff --git a/mozilla/htmlparser/src/nsHTMLTokenizer.cpp b/mozilla/htmlparser/src/nsHTMLTokenizer.cpp
index 05ddc6f1482..3f2e5146699 100644
--- a/mozilla/htmlparser/src/nsHTMLTokenizer.cpp
+++ b/mozilla/htmlparser/src/nsHTMLTokenizer.cpp
@@ -123,6 +123,7 @@ nsHTMLTokenizer::nsHTMLTokenizer(PRInt32 aParseMode,PRBool aPlainText) :
   NS_INIT_REFCNT();
   mDoXMLEmptyTags=PR_FALSE;
   mPlainText=aPlainText;
+  mRecordTrailingContent=PR_FALSE;
 }
 
 
@@ -506,7 +507,13 @@ nsresult nsHTMLTokenizer::ConsumeStartTag(PRUnichar aChar,CToken*& aToken,nsScan
        */
       if(NS_SUCCEEDED(result)) {
         
-        RecordTrailingContent((CStartToken*)aToken,aScanner);
+        //XXX - Find a better soution to record content
+        if(theTag==eHTMLTag_textarea && !mRecordTrailingContent) {
+          mRecordTrailingContent=PR_TRUE;
+        }
+          
+        if(mRecordTrailingContent) 
+          RecordTrailingContent((CStartToken*)aToken,aScanner);
         
         if((eHTMLTag_style==theTag) || (eHTMLTag_script==theTag)) {
           nsAutoString endTag(nsHTMLTags::GetStringValue(theTag));
@@ -550,6 +557,9 @@ nsresult nsHTMLTokenizer::ConsumeEndTag(PRUnichar aChar,CToken*& aToken,nsScanne
   nsresult result=NS_OK;
   
   if(aToken) {
+    if(aToken->GetTypeID()==eHTMLTag_textarea && mRecordTrailingContent) {
+      mRecordTrailingContent=PR_FALSE;
+    }
     result= aToken->Consume(aChar,aScanner,mParseMode);  //tell new token to finish consuming text...    
     AddToken(aToken,result,&mTokenDeque,theRecycler);
   } //if
diff --git a/mozilla/htmlparser/src/nsHTMLTokenizer.h b/mozilla/htmlparser/src/nsHTMLTokenizer.h
index 527f463dd29..a738fc9e57c 100644
--- a/mozilla/htmlparser/src/nsHTMLTokenizer.h
+++ b/mozilla/htmlparser/src/nsHTMLTokenizer.h
@@ -97,6 +97,7 @@ protected:
   PRBool  mDoXMLEmptyTags;
   PRInt32 mParseMode;
   PRBool  mPlainText;
+  PRBool  mRecordTrailingContent;
 };
 
 extern NS_HTMLPARS nsresult NS_NewHTMLTokenizer(nsITokenizer** aInstancePtrResult,PRInt32 aMode,PRBool aPlaintext);
diff --git a/mozilla/htmlparser/src/nsHTMLTokens.cpp b/mozilla/htmlparser/src/nsHTMLTokens.cpp
index a104035f162..cb46060a6fb 100644
--- a/mozilla/htmlparser/src/nsHTMLTokens.cpp
+++ b/mozilla/htmlparser/src/nsHTMLTokens.cpp
@@ -302,7 +302,8 @@ void CStartToken::DebugDumpSource(nsOutputStream& out) {
 void CStartToken::GetSource(nsString& anOutputString){
   anOutputString="<";
   anOutputString+=mTextValue;
-  anOutputString+=mTrailingContent;
+  if(mTrailingContent.Length()>0)
+    anOutputString+=mTrailingContent;
 }
 
 /*
@@ -481,7 +482,7 @@ PRInt32 CTextToken::GetTokenType(void) {
  *  @return  error result
  */
 nsresult CTextToken::Consume(PRUnichar aChar, nsScanner& aScanner,PRInt32 aMode) {
-  static    const char* theTerminals="\n\r&<";
+  static nsString theTerminals("\n\r&<",4);
   nsresult  result=NS_OK;
   PRBool    done=PR_FALSE;
 
@@ -831,47 +832,53 @@ nsresult ConsumeComment(PRUnichar aChar, nsScanner& aScanner,nsString& aString)
           per spec (But then, neither does IE or Nav).
    *********************************************************/
 
-  aString="<!";
-  nsAutoString  theRightChars;
   PRInt32       theBestAltPos=kNotFound;
-  PRUint32      theStartOffset=0;
+  nsString&     theBuffer=aScanner.GetBuffer();
+  PRInt32       theStartOffset=aScanner.GetOffset();
+  PRInt32       theCurrOffset=theStartOffset;
 
   result=aScanner.GetChar(aChar);
   if(NS_OK==result) {
-    aString+=aChar;
     if(kMinus==aChar) {
       result=aScanner.GetChar(aChar);
       if(NS_OK==result) {
         if(kMinus==aChar) {
           //in this case, we're reading a long-form comment <-- xxx -->
-          aString+=aChar;
           
-          PRInt32 findpos=kNotFound;
-          while((kNotFound==findpos) && (NS_OK==result)) {
-            result=aScanner.ReadUntil(aString,kGreaterThan,PR_TRUE);          
-            if(NS_OK==result){
-              aChar=aString.CharAt(aString.Length()-3);
+          while((NS_OK==result)) {
+            theCurrOffset=theBuffer.FindChar(kGreaterThan,PR_TRUE,theCurrOffset);
+            if(theCurrOffset>kNotFound) {
+              theCurrOffset++;
+              aChar=theBuffer[theCurrOffset-3];
               if(kMinus==aChar) {
-                aChar=aString.CharAt(aString.Length()-2);
-                if(kMinus==aChar) return result; // We have found the dflt end comment delimiter ("-->")
+                aChar=theBuffer[theCurrOffset-2];
+                if(kMinus==aChar) {
+                  theStartOffset=theStartOffset-2; // Include "<!" also..
+                  theBuffer.Mid(aString,theStartOffset,theCurrOffset-theStartOffset);
+                  aScanner.Mark(theCurrOffset);
+                  return result; // We have found the dflt end comment delimiter ("-->")
+                }
               }
               if(kNotFound==theBestAltPos) {
                 // If we did not find the dflt then assume that '>' is the end comment
                 // until we find '-->'. Nav. Compatibility -- Ref: Bug# 24006
-                theBestAltPos=aString.Length();
-                theStartOffset=aScanner.GetOffset();
+                theBestAltPos=theCurrOffset;
               }
             }
+            else {
+              result=kEOF;
+            }
           } //while
-          if((kNotFound==findpos) && (!aScanner.IsIncremental())) {
+          if((kNotFound==theCurrOffset) && (!aScanner.IsIncremental())) {
             //if you're here, then we're in a special state. 
             //The problem at hand is that we've hit the end of the document without finding the normal endcomment delimiter "-->".
             //In this case, the first thing we try is to see if we found one of the alternate endcomment delimiter ">".
             //If so, rewind just pass than, and use everything up to that point as your comment.
             //If not, the document has no end comment and should be treated as one big comment.
             if(kNotFound<theBestAltPos) {
-              aString.Truncate(theBestAltPos);
-              aScanner.Mark(theStartOffset);
+              theStartOffset=theStartOffset-2;// Include "<!" also..
+              theBuffer.Mid(aString,theStartOffset,theBestAltPos-theStartOffset);
+              aScanner.Mark(theBestAltPos);
               result=NS_OK;
             }
           }
@@ -1214,7 +1221,7 @@ nsresult ConsumeQuotedString(PRUnichar aChar,nsString& aString,nsScanner& aScann
  */
 static
 nsresult ConsumeAttributeValueText(PRUnichar,nsString& aString,nsScanner& aScanner){
-  static const char* theTerminals="\b\t\n\r >";
+  static nsString theTerminals("\b\t\n\r >",6);
   nsresult result=aScanner.ReadUntil(aString,theTerminals,PR_TRUE,PR_FALSE);
   
   //Let's force quotes if either the first or last char is quoted.
@@ -1274,7 +1281,7 @@ nsresult CAttributeToken::Consume(PRUnichar aChar, nsScanner& aScanner,PRInt32 a
       else {
           //If you're here, handle an unquoted key.
           //Don't forget to reduce entities inline!
-        static const char* theTerminals="\b\t\n\r \"<=>";
+        static nsString theTerminals("\b\t\n\r \"<=>",9);
         result=aScanner.ReadUntil(mTextKey,theTerminals,PR_TRUE,PR_FALSE);
       }
 
diff --git a/mozilla/parser/htmlparser/src/CNavDTD.cpp b/mozilla/parser/htmlparser/src/CNavDTD.cpp
index 91535a08480..7f95a4a3327 100644
--- a/mozilla/parser/htmlparser/src/CNavDTD.cpp
+++ b/mozilla/parser/htmlparser/src/CNavDTD.cpp
@@ -87,9 +87,6 @@ static char gShowCRC;
 #  define START_TIMER()
 #endif
 
-
-
-
 /************************************************************************
   And now for the main class -- CNavDTD...
  ************************************************************************/
@@ -159,6 +156,7 @@ CNavDTD::CNavDTD() : nsIDTD(), mMisplacedContent(0), mSkippedContent(0), mShared
   mStyleHandlingEnabled=PR_TRUE;
   mIsText=PR_FALSE;
   mRequestedHead=PR_FALSE;
+  mIsFormContainer=PR_FALSE;
 
   if(!gHTMLElements) {
     InitializeElementTable();
@@ -1371,11 +1369,6 @@ nsresult CNavDTD::HandleStartToken(CToken* aToken) {
           aToken->SetTypeID(theChildTag=eHTMLTag_img);
           break;
 
-        //case eHTMLTag_userdefined:
-        case eHTMLTag_noscript:     //HACK XXX! Throw noscript on the floor for now.
-          isTokenHandled=PR_TRUE;
-          break;
-
         case eHTMLTag_script:
           theHeadIsParent=((!mHasOpenBody) || mRequestedHead);
           mHasOpenScript=PR_TRUE;
@@ -1387,7 +1380,17 @@ nsresult CNavDTD::HandleStartToken(CToken* aToken) {
       if(!isTokenHandled) {
         if(theHeadIsParent || 
            (mHasOpenHead && ((eHTMLTag_newline==theChildTag) || (eHTMLTag_whitespace==theChildTag)))) {
-              result=AddHeadLeaf(theNode);
+          //Ref. Bug 21008 -- Creating model for NOSCRIPT content
+          static eHTMLTags gNoXTags[]={eHTMLTag_noembed,eHTMLTag_noframes,eHTMLTag_nolayer,eHTMLTag_noscript};
+          if(FindTagInSet(theChildTag,gNoXTags,sizeof(gNoXTags)/sizeof(theChildTag))) {
+             result=OpenContainer(theNode,theChildTag,PR_TRUE);
+          }
+          else if(HasOpenContainer(gNoXTags,sizeof(gNoXTags)/sizeof(eHTMLTag_unknown))) {
+            result=AddLeaf(theNode);   
+          }
+          else {
+            result=AddHeadLeaf(theNode);
+          }
         }
         else result=HandleDefaultStartToken(aToken,theChildTag,theNode); 
       }
@@ -1665,6 +1668,13 @@ nsresult CNavDTD::HandleSavedTokens(PRInt32 anIndex) {
         PRInt32   theTopIndex = anIndex + 1;
         PRInt32   theTagCount = mBodyContext->GetCount();
         eHTMLTags theParentTag= mBodyContext->TagAt(anIndex);
+               
+        //XXX  In the content sink, FORM behaves as a container for parents 
+        //other than eHTMLTag_table,eHTMLTag_tbody,eHTMLTag_tr,eHTMLTag_col,
+        //eHTMLTag_tfoot,eHTMLTag_thead,eHTMLTag_colgroup.In those cases the stack 
+        //position, in the parser, should be synchronized with the sink. -- Ref: Bug 20087.
+
+        if(mHasOpenForm && mIsFormContainer) anIndex++;
 
         STOP_TIMER()
         MOZ_TIMER_DEBUGLOG(("Stop: Parse Time: CNavDTD::HandleSavedTokensAbove(), this=%p\n", this));     
@@ -1681,6 +1691,7 @@ nsresult CNavDTD::HandleSavedTokens(PRInt32 anIndex) {
           mTempContext->Push((nsCParserNode*)mBodyContext->Pop(theChildStyleStack));
         }
      
+        PRInt32 theIndex;
         // Now flush out all the bad contents.
         while(theBadTokenCount > 0){
           theToken=(CToken*)mMisplacedContent.PopFront();
@@ -1694,9 +1705,12 @@ nsresult CNavDTD::HandleSavedTokens(PRInt32 anIndex) {
                 mTokenizer->PushTokenFront(theAttrToken);
               }
             }
+            
             // Make sure that the BeginContext() is ended only by the call to
-            // EndContext(). 
-            if(theTag!=theParentTag || eToken_end!=theToken->GetTokenType())
+            // EndContext(). Ref: Bug 25202
+            if(eToken_end==theToken->GetTokenType()) theIndex=mBodyContext->LastOf(theTag);
+              
+            if(!(theIndex!=kNotFound && theIndex<=mBodyContext->mContextTopIndex))
               result=HandleToken(theToken,mParser);
             else mTokenRecycler->RecycleToken(theToken);
           }
@@ -2187,7 +2201,10 @@ PRBool CNavDTD::CanOmit(eHTMLTags aParent,eHTMLTags aChild,PRBool& aParentContai
       }
     }
     else if (!aParentContains) {
-      return PR_TRUE;
+      if(!gHTMLElements[aChild].HasSpecialProperty(kBadContentWatch)) {
+        return PR_TRUE; 
+      }
+      return PR_FALSE; // Ref. Bug 25658
     }
   }
 
@@ -2643,8 +2660,12 @@ nsresult CNavDTD::CloseBody(const nsIParserNode *aNode){
  * @return  TRUE if ok, FALSE if error
  */
 nsresult CNavDTD::OpenForm(const nsIParserNode *aNode){
+  static eHTMLTags gTableElements[]={eHTMLTag_table,eHTMLTag_tbody,eHTMLTag_tr,eHTMLTag_col,
+                                       eHTMLTag_tfoot,eHTMLTag_thead,eHTMLTag_colgroup};
   if(mHasOpenForm)
     CloseForm(aNode);
+    
+  mIsFormContainer=!(FindTagInSet(mBodyContext->Last(),gTableElements,sizeof(gTableElements)/sizeof(eHTMLTag_unknown)));
 
   STOP_TIMER();
   MOZ_TIMER_DEBUGLOG(("Stop: Parse Time: CNavDTD::OpenForm(), this=%p\n", this));
@@ -2680,6 +2701,9 @@ nsresult CNavDTD::CloseForm(const nsIParserNode *aNode){
 
     MOZ_TIMER_DEBUGLOG(("Start: Parse Time: CNavDTD::CloseForm(), this=%p\n", this));
     START_TIMER();
+        
+    if(mIsFormContainer)
+      mIsFormContainer=PR_FALSE;
 
   }
   return result;
@@ -3283,17 +3307,8 @@ nsresult CNavDTD::AddLeaf(const nsIParserNode *aNode){
 nsresult CNavDTD::AddHeadLeaf(nsIParserNode *aNode){
   nsresult result=NS_OK;
 
-  static eHTMLTags gNoXTags[]={eHTMLTag_noembed,eHTMLTag_noframes,eHTMLTag_nolayer,eHTMLTag_noscript};
-  
-  //this code has been added to prevent <meta> tags from being processed inside
-  //the document if the <meta> tag itself was found in a <noframe>, <nolayer>, or <noscript> tag.
   eHTMLTags theTag=(eHTMLTags)aNode->GetNodeType();
 
-  if(eHTMLTag_meta==theTag)
-    if(HasOpenContainer(gNoXTags,sizeof(gNoXTags)/sizeof(eHTMLTag_unknown))) {
-      return result;
-    }
-
   if(mSink) {
     result=OpenHead(aNode);
     if(NS_OK==result) {
diff --git a/mozilla/parser/htmlparser/src/CNavDTD.h b/mozilla/parser/htmlparser/src/CNavDTD.h
index 0645fd2f980..a8631e4e470 100644
--- a/mozilla/parser/htmlparser/src/CNavDTD.h
+++ b/mozilla/parser/htmlparser/src/CNavDTD.h
@@ -526,6 +526,7 @@ protected:
     PRBool              mStyleHandlingEnabled;
     PRBool              mIsText;
     PRBool              mRequestedHead;
+    PRBool              mIsFormContainer;
 
 #ifdef NS_DEBUG
     PRInt32 gNodeCount;
diff --git a/mozilla/parser/htmlparser/src/nsElementTable.cpp b/mozilla/parser/htmlparser/src/nsElementTable.cpp
index 4e704115efa..95b33ee69f3 100644
--- a/mozilla/parser/htmlparser/src/nsElementTable.cpp
+++ b/mozilla/parser/htmlparser/src/nsElementTable.cpp
@@ -49,7 +49,9 @@ TagList  gInTR={1,{eHTMLTag_tr}};
 TagList  gInDL={2,{eHTMLTag_dl,eHTMLTag_body}};
 TagList  gInFrameset={1,{eHTMLTag_frameset}};
 TagList  gInNoframes={1,{eHTMLTag_noframes}};
-TagList  gInP={3,{eHTMLTag_address,eHTMLTag_span,eHTMLTag_form}}; // P used to contain TABLE - Ref: Bug# 11229 - Removed TABLE to solve Bug# 24673
+// P used to contain TABLE [Ref: Bug# 11229], and ADDRESS.
+// Removed TABLE to solve Bug# 24673. Removed ADDRESS to solve 24885
+TagList  gInP={2,{eHTMLTag_span,eHTMLTag_form}}; 
 TagList  gOptgroupParents={2,{eHTMLTag_select,eHTMLTag_optgroup}};
 TagList  gBodyParents={2,{eHTMLTag_html,eHTMLTag_noframes}};
 TagList  gColParents={2,{eHTMLTag_table,eHTMLTag_colgroup}};
@@ -88,13 +90,13 @@ TagList  gLIKids={2,{eHTMLTag_ol,eHTMLTag_ul}};
 TagList  gMapKids={1,{eHTMLTag_area}};
 TagList  gPreKids={2,{eHTMLTag_hr,eHTMLTag_center}};  //note that CENTER is here for backward compatibility; it's not 4.0 spec.
 
-TagList  gTableKids={10,{eHTMLTag_caption,eHTMLTag_col,eHTMLTag_colgroup,eHTMLTag_form,
+TagList  gTableKids={9,{eHTMLTag_caption,eHTMLTag_col,eHTMLTag_colgroup,eHTMLTag_form,
                      eHTMLTag_thead,eHTMLTag_tbody,eHTMLTag_tfoot,
-                     eHTMLTag_map,eHTMLTag_script,eHTMLTag_input}};
+                     eHTMLTag_map,eHTMLTag_script}};// Removed INPUT - Ref. Bug 20087, 25382
   
 TagList  gTableElemKids={7,{eHTMLTag_form,eHTMLTag_map,eHTMLTag_noscript,eHTMLTag_script,eHTMLTag_td,eHTMLTag_th,eHTMLTag_tr}};
-TagList  gTRKids={6,{eHTMLTag_td,eHTMLTag_th,eHTMLTag_map,eHTMLTag_form,eHTMLTag_script,eHTMLTag_input}};
-TagList  gTBodyKids={3,{eHTMLTag_tr,eHTMLTag_form,eHTMLTag_input}};
+TagList  gTRKids={5,{eHTMLTag_td,eHTMLTag_th,eHTMLTag_map,eHTMLTag_form,eHTMLTag_script}};// Removed INPUT - Ref. Bug 20087, 25382
+TagList  gTBodyKids={2,{eHTMLTag_tr,eHTMLTag_form}}; // Removed INPUT - Ref. Bug 20087, 25382
 TagList  gULKids={2,{eHTMLTag_li,eHTMLTag_p}};
 
 
@@ -134,6 +136,8 @@ TagList  gDTCloseTags={3,{eHTMLTag_dt,eHTMLTag_dd,eHTMLTag_p}};
 TagList  gULCloseTags={1,{eHTMLTag_li}};
 
 
+TagList  gBlockQuoteExcludableParents={1,{eHTMLTag_pre}}; // Ref Bug 22913
+
 //*********************************************************************************************
 //Lastly, bind tags with their rules, their special parents and special kids.
 //*********************************************************************************************
@@ -160,7 +164,7 @@ void Initialize(eHTMLTags aTag,
                 TagList*  aAutocloseStart,    
                 TagList*  aAutocloseEnd,      
                 TagList*  aSynonymousTags,    
-                TagList*  aAutoCloseBlockers,  
+                TagList*  aExcludableParents,  
                 int       aParentBits,        
                 int       aInclusionBits, 
                 int       aExclusionBits,     
@@ -179,7 +183,7 @@ void Initialize(eHTMLTags aTag,
   gHTMLElements[aTag].mAutocloseStart=aAutocloseStart;
   gHTMLElements[aTag].mAutocloseEnd=aAutocloseEnd;
   gHTMLElements[aTag].mSynonymousTags=aSynonymousTags;
-  gHTMLElements[aTag].mAutoCloseBlockers=aAutoCloseBlockers;
+  gHTMLElements[aTag].mExcludableParents=aExcludableParents;
   gHTMLElements[aTag].mParentBits=aParentBits;
   gHTMLElements[aTag].mInclusionBits=aInclusionBits;
   gHTMLElements[aTag].mExclusionBits=aExclusionBits;
@@ -331,7 +335,7 @@ void InitializeElementTable(void) {
       /*tag*/                             eHTMLTag_blockquote,
       /*req-parent excl-parent*/          eHTMLTag_unknown,eHTMLTag_unknown,
 	    /*rootnodes,endrootnodes*/          &gRootTags,&gRootTags,	
-      /*autoclose starttags and endtags*/ 0,0,0,0,
+      /*autoclose starttags and endtags*/ 0,0,0,&gBlockQuoteExcludableParents,
       /*parent,incl,exclgroups*/          kBlock, (kSelf|kFlowEntity), kNone,	
       /*special props, prop-range*/       0,kDefaultPropRange,
       /*special parents,kids,skip*/       0,0,eHTMLTag_unknown);
@@ -857,7 +861,7 @@ void InitializeElementTable(void) {
       /*autoclose starttags and endtags*/ 0,0,0,0,
       /*parent,incl,exclgroups*/          kBlock, kFlowEntity|kSelf, kNone,	
       /*special props, prop-range*/       0, kNoPropRange,
-      /*special parents,kids,skip*/       0,0,eHTMLTag_noscript);
+      /*special parents,kids,skip*/       0,0,eHTMLTag_unknown);
 
     Initialize( 
       /*tag*/                             eHTMLTag_object,
@@ -874,7 +878,7 @@ void InitializeElementTable(void) {
 	    /*rootnodes,endrootnodes*/          &gOLRootTags,&gOLRootTags,	
       /*autoclose starttags and endtags*/ &gOLAutoClose, &gULCloseTags, 0,0,
       /*parent,incl,exclgroups*/          kList, (kFlowEntity|kSelf), kNone,	
-      /*special props, prop-range*/       0,kDefaultPropRange,
+      /*special props, prop-range*/       0,kDefaultPropRange,   
       /*special parents,kids,skip*/       0,&gULKids,eHTMLTag_unknown);
 
     Initialize( 
@@ -1009,8 +1013,8 @@ void InitializeElementTable(void) {
       /*req-parent excl-parent*/          eHTMLTag_unknown,eHTMLTag_unknown,
 	    /*rootnodes,endrootnodes*/          &gRootTags,&gRootTags,	
       /*autoclose starttags and endtags*/ 0,0,0,0,
-      /*parent,incl,exclgroups*/          kNone, kNone, kNone,	
-      /*special props, prop-range*/       0,kDefaultPropRange,
+      /*parent,incl,exclgroups*/          (kFlowEntity|kHeadContent), kNone, kNone,	 // Added kFlowEntity|kHeadContent & kNonContainer in
+      /*special props, prop-range*/       kNonContainer,kDefaultPropRange,           // Ref. to Bug 25749
       /*special parents,kids,skip*/       0,0,eHTMLTag_unknown);
 
     Initialize( 
@@ -1443,7 +1447,6 @@ PRBool nsHTMLElement::IsBlockParent(eHTMLTags aTag){
   return result;
 }
 
-
 /**
  * 
  * @update	gess 01/04/99
@@ -1861,6 +1864,11 @@ PRBool nsHTMLElement::CanContain(eHTMLTags aChild) const{
         return PR_FALSE;
     }
 
+    if(gHTMLElements[aChild].mExcludableParents) {
+      TagList* theParents=gHTMLElements[aChild].mExcludableParents;
+      if(FindTagInSet(mTagID,theParents->mTags,theParents->mCount))
+        return PR_FALSE;
+    }
 
     if(gHTMLElements[aChild].IsBlockCloser(aChild)){
       if(nsHTMLElement::IsBlockParent(mTagID)){
diff --git a/mozilla/parser/htmlparser/src/nsElementTable.h b/mozilla/parser/htmlparser/src/nsElementTable.h
index eb7709c57f3..da082093f68 100644
--- a/mozilla/parser/htmlparser/src/nsElementTable.h
+++ b/mozilla/parser/htmlparser/src/nsElementTable.h
@@ -194,7 +194,7 @@ struct nsHTMLElement {
   TagList*        mAutocloseStart;    //these are the start tags that you can automatically close with this START tag
   TagList*        mAutocloseEnd;      //these are the start tags that you can automatically close with this END tag
   TagList*        mSynonymousTags;    //These are morally equivalent; an end tag for one can close a start tag for another (like <Hn>)
-  TagList*        mAutoCloseBlockers; //...
+  TagList*        mExcludableParents; //These are the TAGS that cannot contain you
   int             mParentBits;        //defines groups that can contain this element
   int             mInclusionBits;     //defines parental and containment rules
   int             mExclusionBits;     //defines things you CANNOT contain
diff --git a/mozilla/parser/htmlparser/src/nsHTMLTokenizer.cpp b/mozilla/parser/htmlparser/src/nsHTMLTokenizer.cpp
index 05ddc6f1482..3f2e5146699 100644
--- a/mozilla/parser/htmlparser/src/nsHTMLTokenizer.cpp
+++ b/mozilla/parser/htmlparser/src/nsHTMLTokenizer.cpp
@@ -123,6 +123,7 @@ nsHTMLTokenizer::nsHTMLTokenizer(PRInt32 aParseMode,PRBool aPlainText) :
   NS_INIT_REFCNT();
   mDoXMLEmptyTags=PR_FALSE;
   mPlainText=aPlainText;
+  mRecordTrailingContent=PR_FALSE;
 }
 
 
@@ -506,7 +507,13 @@ nsresult nsHTMLTokenizer::ConsumeStartTag(PRUnichar aChar,CToken*& aToken,nsScan
        */
       if(NS_SUCCEEDED(result)) {
         
-        RecordTrailingContent((CStartToken*)aToken,aScanner);
+        //XXX - Find a better soution to record content
+        if(theTag==eHTMLTag_textarea && !mRecordTrailingContent) {
+          mRecordTrailingContent=PR_TRUE;
+        }
+          
+        if(mRecordTrailingContent) 
+          RecordTrailingContent((CStartToken*)aToken,aScanner);
         
         if((eHTMLTag_style==theTag) || (eHTMLTag_script==theTag)) {
           nsAutoString endTag(nsHTMLTags::GetStringValue(theTag));
@@ -550,6 +557,9 @@ nsresult nsHTMLTokenizer::ConsumeEndTag(PRUnichar aChar,CToken*& aToken,nsScanne
   nsresult result=NS_OK;
   
   if(aToken) {
+    if(aToken->GetTypeID()==eHTMLTag_textarea && mRecordTrailingContent) {
+      mRecordTrailingContent=PR_FALSE;
+    }
     result= aToken->Consume(aChar,aScanner,mParseMode);  //tell new token to finish consuming text...    
     AddToken(aToken,result,&mTokenDeque,theRecycler);
   } //if
diff --git a/mozilla/parser/htmlparser/src/nsHTMLTokenizer.h b/mozilla/parser/htmlparser/src/nsHTMLTokenizer.h
index 527f463dd29..a738fc9e57c 100644
--- a/mozilla/parser/htmlparser/src/nsHTMLTokenizer.h
+++ b/mozilla/parser/htmlparser/src/nsHTMLTokenizer.h
@@ -97,6 +97,7 @@ protected:
   PRBool  mDoXMLEmptyTags;
   PRInt32 mParseMode;
   PRBool  mPlainText;
+  PRBool  mRecordTrailingContent;
 };
 
 extern NS_HTMLPARS nsresult NS_NewHTMLTokenizer(nsITokenizer** aInstancePtrResult,PRInt32 aMode,PRBool aPlaintext);
diff --git a/mozilla/parser/htmlparser/src/nsHTMLTokens.cpp b/mozilla/parser/htmlparser/src/nsHTMLTokens.cpp
index a104035f162..cb46060a6fb 100644
--- a/mozilla/parser/htmlparser/src/nsHTMLTokens.cpp
+++ b/mozilla/parser/htmlparser/src/nsHTMLTokens.cpp
@@ -302,7 +302,8 @@ void CStartToken::DebugDumpSource(nsOutputStream& out) {
 void CStartToken::GetSource(nsString& anOutputString){
   anOutputString="<";
   anOutputString+=mTextValue;
-  anOutputString+=mTrailingContent;
+  if(mTrailingContent.Length()>0)
+    anOutputString+=mTrailingContent;
 }
 
 /*
@@ -481,7 +482,7 @@ PRInt32 CTextToken::GetTokenType(void) {
  *  @return  error result
  */
 nsresult CTextToken::Consume(PRUnichar aChar, nsScanner& aScanner,PRInt32 aMode) {
-  static    const char* theTerminals="\n\r&<";
+  static nsString theTerminals("\n\r&<",4);
   nsresult  result=NS_OK;
   PRBool    done=PR_FALSE;
 
@@ -831,47 +832,53 @@ nsresult ConsumeComment(PRUnichar aChar, nsScanner& aScanner,nsString& aString)
           per spec (But then, neither does IE or Nav).
    *********************************************************/
 
-  aString="<!";
-  nsAutoString  theRightChars;
   PRInt32       theBestAltPos=kNotFound;
-  PRUint32      theStartOffset=0;
+  nsString&     theBuffer=aScanner.GetBuffer();
+  PRInt32       theStartOffset=aScanner.GetOffset();
+  PRInt32       theCurrOffset=theStartOffset;
 
   result=aScanner.GetChar(aChar);
   if(NS_OK==result) {
-    aString+=aChar;
     if(kMinus==aChar) {
       result=aScanner.GetChar(aChar);
       if(NS_OK==result) {
         if(kMinus==aChar) {
           //in this case, we're reading a long-form comment <-- xxx -->
-          aString+=aChar;
           
-          PRInt32 findpos=kNotFound;
-          while((kNotFound==findpos) && (NS_OK==result)) {
-            result=aScanner.ReadUntil(aString,kGreaterThan,PR_TRUE);          
-            if(NS_OK==result){
-              aChar=aString.CharAt(aString.Length()-3);
+          while((NS_OK==result)) {
+            theCurrOffset=theBuffer.FindChar(kGreaterThan,PR_TRUE,theCurrOffset);
+            if(theCurrOffset>kNotFound) {
+              theCurrOffset++;
+              aChar=theBuffer[theCurrOffset-3];
               if(kMinus==aChar) {
-                aChar=aString.CharAt(aString.Length()-2);
-                if(kMinus==aChar) return result; // We have found the dflt end comment delimiter ("-->")
+                aChar=theBuffer[theCurrOffset-2];
+                if(kMinus==aChar) {
+                  theStartOffset=theStartOffset-2; // Include "<!" also..
+                  theBuffer.Mid(aString,theStartOffset,theCurrOffset-theStartOffset);
+                  aScanner.Mark(theCurrOffset);
+                  return result; // We have found the dflt end comment delimiter ("-->")
+                }
               }
               if(kNotFound==theBestAltPos) {
                 // If we did not find the dflt then assume that '>' is the end comment
                 // until we find '-->'. Nav. Compatibility -- Ref: Bug# 24006
-                theBestAltPos=aString.Length();
-                theStartOffset=aScanner.GetOffset();
+                theBestAltPos=theCurrOffset;
               }
             }
+            else {
+              result=kEOF;
+            }
           } //while
-          if((kNotFound==findpos) && (!aScanner.IsIncremental())) {
+          if((kNotFound==theCurrOffset) && (!aScanner.IsIncremental())) {
             //if you're here, then we're in a special state. 
             //The problem at hand is that we've hit the end of the document without finding the normal endcomment delimiter "-->".
             //In this case, the first thing we try is to see if we found one of the alternate endcomment delimiter ">".
             //If so, rewind just pass than, and use everything up to that point as your comment.
             //If not, the document has no end comment and should be treated as one big comment.
             if(kNotFound<theBestAltPos) {
-              aString.Truncate(theBestAltPos);
-              aScanner.Mark(theStartOffset);
+              theStartOffset=theStartOffset-2;// Include "<!" also..
+              theBuffer.Mid(aString,theStartOffset,theBestAltPos-theStartOffset);
+              aScanner.Mark(theBestAltPos);
               result=NS_OK;
             }
           }
@@ -1214,7 +1221,7 @@ nsresult ConsumeQuotedString(PRUnichar aChar,nsString& aString,nsScanner& aScann
  */
 static
 nsresult ConsumeAttributeValueText(PRUnichar,nsString& aString,nsScanner& aScanner){
-  static const char* theTerminals="\b\t\n\r >";
+  static nsString theTerminals("\b\t\n\r >",6);
   nsresult result=aScanner.ReadUntil(aString,theTerminals,PR_TRUE,PR_FALSE);
   
   //Let's force quotes if either the first or last char is quoted.
@@ -1274,7 +1281,7 @@ nsresult CAttributeToken::Consume(PRUnichar aChar, nsScanner& aScanner,PRInt32 a
       else {
           //If you're here, handle an unquoted key.
           //Don't forget to reduce entities inline!
-        static const char* theTerminals="\b\t\n\r \"<=>";
+        static nsString theTerminals("\b\t\n\r \"<=>",9);
         result=aScanner.ReadUntil(mTextKey,theTerminals,PR_TRUE,PR_FALSE);
       }