diff --git a/mozilla/content/html/document/src/nsHTMLContentSink.cpp b/mozilla/content/html/document/src/nsHTMLContentSink.cpp
index 3fbf9325bdf..024b68d8566 100644
--- a/mozilla/content/html/document/src/nsHTMLContentSink.cpp
+++ b/mozilla/content/html/document/src/nsHTMLContentSink.cpp
@@ -538,10 +538,12 @@ MakeContentObject(nsHTMLTag aNodeType,
     break;
   case eHTMLTag_form:
     // the form was already created 
-    *aResult = nsnull;
     if (aForm) {
       rv = aForm->QueryInterface(kIHTMLContentIID, (void**)aResult);
     }
+    else {
+      rv = NS_NewHTMLFormElement(aResult, aAtom);
+    }
     break;
   case eHTMLTag_frame:
     rv = NS_NewHTMLFrameElement(aResult, aAtom);
diff --git a/mozilla/content/xml/document/src/nsXMLContentSink.cpp b/mozilla/content/xml/document/src/nsXMLContentSink.cpp
index f5ad2ce3d39..5bedc97bb92 100644
--- a/mozilla/content/xml/document/src/nsXMLContentSink.cpp
+++ b/mozilla/content/xml/document/src/nsXMLContentSink.cpp
@@ -455,7 +455,8 @@ nsXMLContentSink::OpenContainer(const nsIParserNode& aNode)
   nsAutoString tag, nameSpace;
   PRInt32 nsoffset;
   PRInt32 id = gNameSpaceId_Unknown;
-  PRBool isHTML = nsnull;
+  PRBool isHTML = PR_FALSE;
+  PRBool pushContent = PR_TRUE;
   nsIContent *content;
 
   // XXX Hopefully the parser will flag this before we get
@@ -494,7 +495,13 @@ nsXMLContentSink::OpenContainer(const nsIParserNode& aNode)
     if (nsHTMLAtoms::script == tagAtom) {
       result = ProcessStartSCRIPTTag(aNode);
     }
+    // XXX Treat the form elements as a leaf element (even if it is a
+    // container). Need to do further processing with forms
+    else if (nsHTMLAtoms::form == tagAtom) {
+      pushContent = PR_FALSE;
+    }
     NS_RELEASE(tagAtom);
+
     nsIHTMLContent *htmlContent = nsnull;
     result = NS_CreateHTMLElement(&htmlContent, tag);
     content = (nsIContent *)htmlContent;
@@ -533,7 +540,9 @@ nsXMLContentSink::OpenContainer(const nsIParserNode& aNode)
 
         parent->AppendChildTo(content, PR_FALSE);
       }
-      PushContent(content);
+      if (pushContent) {
+        PushContent(content);
+      }
     }
   }
 
@@ -547,7 +556,8 @@ nsXMLContentSink::CloseContainer(const nsIParserNode& aNode)
   nsAutoString tag, nameSpace;
   PRInt32 nsoffset;
   PRInt32 id = gNameSpaceId_Unknown;
-  PRBool isHTML = nsnull;
+  PRBool isHTML = PR_FALSE;
+  PRBool popContent = PR_TRUE;
 
   // XXX Hopefully the parser will flag this before we get
   // here. If we're in the prolog or epilog, there should be
@@ -571,30 +581,36 @@ nsXMLContentSink::CloseContainer(const nsIParserNode& aNode)
     FlushText();
   }
 
-  nsIContent* content = PopContent();
-  if (nsnull != content) {
-    PRInt32 nestLevel = GetCurrentNestLevel();
-
-    if (isHTML) {
-      tag.ToUpperCase();
-      nsIAtom* tagAtom = NS_NewAtom(tag);
-      if (nsHTMLAtoms::script == tagAtom) {
-        result = ProcessEndSCRIPTTag(aNode);
-      }
-      NS_RELEASE(tagAtom);
+  if (isHTML) {
+    tag.ToUpperCase();
+    nsIAtom* tagAtom = NS_NewAtom(tag);
+    if (nsHTMLAtoms::script == tagAtom) {
+      result = ProcessEndSCRIPTTag(aNode);
     }
-
-    CloseNameSpacesAtNestLevel(nestLevel);
-
-    if (mDocElement == content) {
-      mState = eXMLContentSinkState_InEpilog;
+    // XXX Form content was never pushed on the stack
+    else if (nsHTMLAtoms::form == tagAtom) {
+      popContent = PR_FALSE;
     }
-    NS_RELEASE(content);
+    NS_RELEASE(tagAtom);
   }
-  else {
-    // XXX Again, the parser should catch unmatched tags and
-    // we should never get here.
-    PR_ASSERT(0);
+
+  if (popContent) {
+    nsIContent* content = PopContent();
+    if (nsnull != content) {
+      PRInt32 nestLevel = GetCurrentNestLevel();
+      
+      CloseNameSpacesAtNestLevel(nestLevel);
+      
+      if (mDocElement == content) {
+        mState = eXMLContentSinkState_InEpilog;
+    }
+      NS_RELEASE(content);
+    }
+    else {
+      // XXX Again, the parser should catch unmatched tags and
+      // we should never get here.
+      PR_ASSERT(0);
+    }
   }
 
   return result;
diff --git a/mozilla/content/xml/document/src/nsXMLDocument.cpp b/mozilla/content/xml/document/src/nsXMLDocument.cpp
index c9edb1a7270..7b81022a553 100644
--- a/mozilla/content/xml/document/src/nsXMLDocument.cpp
+++ b/mozilla/content/xml/document/src/nsXMLDocument.cpp
@@ -265,6 +265,9 @@ NS_IMETHODIMP
 nsXMLDocument::CreateElement(const nsString& aTagName, 
                               nsIDOMElement** aReturn)
 {
+  // XXX Should actually check parse namespace, determine
+  // current namespace scope and, potentially, create new
+  // HTML content form tags with a HTML prefix.
   nsIXMLContent* content;
   nsIAtom* tag = NS_NewAtom(aTagName);
   nsresult rv = NS_NewXMLElement(&content, tag);
diff --git a/mozilla/layout/html/document/src/nsHTMLContentSink.cpp b/mozilla/layout/html/document/src/nsHTMLContentSink.cpp
index 3fbf9325bdf..024b68d8566 100644
--- a/mozilla/layout/html/document/src/nsHTMLContentSink.cpp
+++ b/mozilla/layout/html/document/src/nsHTMLContentSink.cpp
@@ -538,10 +538,12 @@ MakeContentObject(nsHTMLTag aNodeType,
     break;
   case eHTMLTag_form:
     // the form was already created 
-    *aResult = nsnull;
     if (aForm) {
       rv = aForm->QueryInterface(kIHTMLContentIID, (void**)aResult);
     }
+    else {
+      rv = NS_NewHTMLFormElement(aResult, aAtom);
+    }
     break;
   case eHTMLTag_frame:
     rv = NS_NewHTMLFrameElement(aResult, aAtom);
diff --git a/mozilla/layout/xml/document/src/nsXMLContentSink.cpp b/mozilla/layout/xml/document/src/nsXMLContentSink.cpp
index f5ad2ce3d39..5bedc97bb92 100644
--- a/mozilla/layout/xml/document/src/nsXMLContentSink.cpp
+++ b/mozilla/layout/xml/document/src/nsXMLContentSink.cpp
@@ -455,7 +455,8 @@ nsXMLContentSink::OpenContainer(const nsIParserNode& aNode)
   nsAutoString tag, nameSpace;
   PRInt32 nsoffset;
   PRInt32 id = gNameSpaceId_Unknown;
-  PRBool isHTML = nsnull;
+  PRBool isHTML = PR_FALSE;
+  PRBool pushContent = PR_TRUE;
   nsIContent *content;
 
   // XXX Hopefully the parser will flag this before we get
@@ -494,7 +495,13 @@ nsXMLContentSink::OpenContainer(const nsIParserNode& aNode)
     if (nsHTMLAtoms::script == tagAtom) {
       result = ProcessStartSCRIPTTag(aNode);
     }
+    // XXX Treat the form elements as a leaf element (even if it is a
+    // container). Need to do further processing with forms
+    else if (nsHTMLAtoms::form == tagAtom) {
+      pushContent = PR_FALSE;
+    }
     NS_RELEASE(tagAtom);
+
     nsIHTMLContent *htmlContent = nsnull;
     result = NS_CreateHTMLElement(&htmlContent, tag);
     content = (nsIContent *)htmlContent;
@@ -533,7 +540,9 @@ nsXMLContentSink::OpenContainer(const nsIParserNode& aNode)
 
         parent->AppendChildTo(content, PR_FALSE);
       }
-      PushContent(content);
+      if (pushContent) {
+        PushContent(content);
+      }
     }
   }
 
@@ -547,7 +556,8 @@ nsXMLContentSink::CloseContainer(const nsIParserNode& aNode)
   nsAutoString tag, nameSpace;
   PRInt32 nsoffset;
   PRInt32 id = gNameSpaceId_Unknown;
-  PRBool isHTML = nsnull;
+  PRBool isHTML = PR_FALSE;
+  PRBool popContent = PR_TRUE;
 
   // XXX Hopefully the parser will flag this before we get
   // here. If we're in the prolog or epilog, there should be
@@ -571,30 +581,36 @@ nsXMLContentSink::CloseContainer(const nsIParserNode& aNode)
     FlushText();
   }
 
-  nsIContent* content = PopContent();
-  if (nsnull != content) {
-    PRInt32 nestLevel = GetCurrentNestLevel();
-
-    if (isHTML) {
-      tag.ToUpperCase();
-      nsIAtom* tagAtom = NS_NewAtom(tag);
-      if (nsHTMLAtoms::script == tagAtom) {
-        result = ProcessEndSCRIPTTag(aNode);
-      }
-      NS_RELEASE(tagAtom);
+  if (isHTML) {
+    tag.ToUpperCase();
+    nsIAtom* tagAtom = NS_NewAtom(tag);
+    if (nsHTMLAtoms::script == tagAtom) {
+      result = ProcessEndSCRIPTTag(aNode);
     }
-
-    CloseNameSpacesAtNestLevel(nestLevel);
-
-    if (mDocElement == content) {
-      mState = eXMLContentSinkState_InEpilog;
+    // XXX Form content was never pushed on the stack
+    else if (nsHTMLAtoms::form == tagAtom) {
+      popContent = PR_FALSE;
     }
-    NS_RELEASE(content);
+    NS_RELEASE(tagAtom);
   }
-  else {
-    // XXX Again, the parser should catch unmatched tags and
-    // we should never get here.
-    PR_ASSERT(0);
+
+  if (popContent) {
+    nsIContent* content = PopContent();
+    if (nsnull != content) {
+      PRInt32 nestLevel = GetCurrentNestLevel();
+      
+      CloseNameSpacesAtNestLevel(nestLevel);
+      
+      if (mDocElement == content) {
+        mState = eXMLContentSinkState_InEpilog;
+    }
+      NS_RELEASE(content);
+    }
+    else {
+      // XXX Again, the parser should catch unmatched tags and
+      // we should never get here.
+      PR_ASSERT(0);
+    }
   }
 
   return result;
diff --git a/mozilla/layout/xml/document/src/nsXMLDocument.cpp b/mozilla/layout/xml/document/src/nsXMLDocument.cpp
index c9edb1a7270..7b81022a553 100644
--- a/mozilla/layout/xml/document/src/nsXMLDocument.cpp
+++ b/mozilla/layout/xml/document/src/nsXMLDocument.cpp
@@ -265,6 +265,9 @@ NS_IMETHODIMP
 nsXMLDocument::CreateElement(const nsString& aTagName, 
                               nsIDOMElement** aReturn)
 {
+  // XXX Should actually check parse namespace, determine
+  // current namespace scope and, potentially, create new
+  // HTML content form tags with a HTML prefix.
   nsIXMLContent* content;
   nsIAtom* tag = NS_NewAtom(aTagName);
   nsresult rv = NS_NewXMLElement(&content, tag);