diff --git a/mozilla/content/html/content/src/nsGenericHTMLElement.cpp b/mozilla/content/html/content/src/nsGenericHTMLElement.cpp
index 78177eefb4c..22a9d54a76b 100644
--- a/mozilla/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/mozilla/content/html/content/src/nsGenericHTMLElement.cpp
@@ -1676,39 +1676,47 @@ nsGenericHTMLElement::SetAttr(nsINodeInfo* aNodeInfo,
 
 PRBool nsGenericHTMLElement::IsEventName(nsIAtom* aName)
 {
-  return (nsLayoutAtoms::onclick == aName ||
-    nsLayoutAtoms::ondblclick == aName ||
-    nsLayoutAtoms::onmousedown == aName ||
-    nsLayoutAtoms::onmouseup == aName ||
-    nsLayoutAtoms::onmouseover == aName ||
-    nsLayoutAtoms::onmouseout == aName ||
-    nsLayoutAtoms::onkeydown == aName ||
-    nsLayoutAtoms::onkeyup == aName ||
-    nsLayoutAtoms::onkeypress == aName ||
-    nsLayoutAtoms::onmousemove == aName ||
-    nsLayoutAtoms::onload == aName ||
-    nsLayoutAtoms::onunload == aName ||
-    nsLayoutAtoms::onabort == aName ||
-    nsLayoutAtoms::onerror == aName ||
-    nsLayoutAtoms::onfocus == aName ||
-    nsLayoutAtoms::onblur == aName ||
-    nsLayoutAtoms::onsubmit == aName ||
-    nsLayoutAtoms::onreset == aName ||
-    nsLayoutAtoms::onchange == aName ||
-    nsLayoutAtoms::onselect == aName || 
-    nsLayoutAtoms::onpaint == aName ||
-    nsLayoutAtoms::onresize == aName ||
-    nsLayoutAtoms::onscroll == aName ||
-    nsLayoutAtoms::oninput == aName ||
-    nsLayoutAtoms::oncontextmenu == aName || 
-    nsLayoutAtoms::onDOMAttrModified == aName ||
-    nsLayoutAtoms::onDOMCharacterDataModified == aName || 
-    nsLayoutAtoms::onDOMSubtreeModified == aName ||
-    nsLayoutAtoms::onDOMNodeInsertedIntoDocument == aName || 
-    nsLayoutAtoms::onDOMNodeRemovedFromDocument == aName ||
-    nsLayoutAtoms::onDOMNodeInserted  == aName || 
-    nsLayoutAtoms::onDOMNodeRemoved == aName
-    );
+  const PRUnichar *name = nsnull;
+
+  aName->GetUnicode(&name);
+  NS_ASSERTION(name, "Null string in atom!");
+
+  if (name[0] != 'o' || name[1] != 'n') {
+    return PR_FALSE;
+  }
+
+  return (aName == nsLayoutAtoms::onclick                       ||
+          aName == nsLayoutAtoms::ondblclick                    ||
+          aName == nsLayoutAtoms::onmousedown                   ||
+          aName == nsLayoutAtoms::onmouseup                     ||
+          aName == nsLayoutAtoms::onmouseover                   ||
+          aName == nsLayoutAtoms::onmouseout                    ||
+          aName == nsLayoutAtoms::onkeydown                     ||
+          aName == nsLayoutAtoms::onkeyup                       ||
+          aName == nsLayoutAtoms::onkeypress                    ||
+          aName == nsLayoutAtoms::onmousemove                   ||
+          aName == nsLayoutAtoms::onload                        ||
+          aName == nsLayoutAtoms::onunload                      ||
+          aName == nsLayoutAtoms::onabort                       ||
+          aName == nsLayoutAtoms::onerror                       ||
+          aName == nsLayoutAtoms::onfocus                       ||
+          aName == nsLayoutAtoms::onblur                        ||
+          aName == nsLayoutAtoms::onsubmit                      ||
+          aName == nsLayoutAtoms::onreset                       ||
+          aName == nsLayoutAtoms::onchange                      ||
+          aName == nsLayoutAtoms::onselect                      || 
+          aName == nsLayoutAtoms::onpaint                       ||
+          aName == nsLayoutAtoms::onresize                      ||
+          aName == nsLayoutAtoms::onscroll                      ||
+          aName == nsLayoutAtoms::oninput                       ||
+          aName == nsLayoutAtoms::oncontextmenu                 ||
+          aName == nsLayoutAtoms::onDOMAttrModified             ||
+          aName == nsLayoutAtoms::onDOMCharacterDataModified    || 
+          aName == nsLayoutAtoms::onDOMSubtreeModified          ||
+          aName == nsLayoutAtoms::onDOMNodeInsertedIntoDocument || 
+          aName == nsLayoutAtoms::onDOMNodeRemovedFromDocument  ||
+          aName == nsLayoutAtoms::onDOMNodeInserted             || 
+          aName == nsLayoutAtoms::onDOMNodeRemoved);
 }
 
 static PRInt32 GetStyleImpactFrom(const nsHTMLValue& aValue)
diff --git a/mozilla/content/html/document/src/nsHTMLContentSink.cpp b/mozilla/content/html/document/src/nsHTMLContentSink.cpp
index 416b25ab291..78c585a7758 100644
--- a/mozilla/content/html/document/src/nsHTMLContentSink.cpp
+++ b/mozilla/content/html/document/src/nsHTMLContentSink.cpp
@@ -338,9 +338,8 @@ public:
   PRBool IsTimeToNotify();
   PRBool IsInScript();
   void ReduceEntities(nsString& aString);
-  void GetAttributeValueAt(const nsIParserNode& aNode,
-                           PRInt32 aIndex,
-                           nsString& aResult);
+  const nsDependentSubstring GetAttributeValueAt(const nsIParserNode& aNode,
+                                                 PRInt32 aIndex);
   nsresult AddAttributes(const nsIParserNode& aNode, nsIHTMLContent* aContent,
                          PRBool aNotify = PR_FALSE);
   nsresult CreateContentObject(const nsIParserNode& aNode,
@@ -739,14 +738,13 @@ GetEntityTerminator(nsString& aSource,PRUnichar& aChar,PRInt32 aStartOffset=0) {
  * it as a string. Whitespace in the end and beginning are stripped from
  * the string. 
  */
-void
+const nsDependentSubstring
 HTMLContentSink::GetAttributeValueAt(const nsIParserNode& aNode,
-                                     PRInt32 aIndex,
-                                     nsString& aResult)
+                                     PRInt32 aIndex)
 {
   // Copy value
   const nsString& value = aNode.GetValueAt(aIndex);
-  nsAString::const_iterator iter, end_iter;
+  nsString::const_iterator iter, end_iter;
   value.BeginReading(iter);
   value.EndReading(end_iter);
   PRUnichar the_char;
@@ -756,28 +754,28 @@ HTMLContentSink::GetAttributeValueAt(const nsIParserNode& aNode,
          (((the_char = *iter) == '\n') ||
           (the_char == '\t') ||
           (the_char == '\r') ||
-          (the_char == '\b')))
+          (the_char == '\b'))) {
     ++iter;
-
-  if (iter == end_iter) {
-    // Nothing left
-    aResult.Truncate();
-    return;
   }
 
-  --end_iter; // To make it point to a char
+  if (iter != end_iter) {
+    --end_iter; // To make it point to a char
 
-  // There has to be a char between the whitespace,
-  // otherwise iter would be equal to end_iter, so
-  // we can just go until we find that char.
-  while (((the_char = *end_iter)== '\n') ||
-         (the_char == '\t') ||
-         (the_char == '\r') ||
-         (the_char == '\b'))
-    --end_iter;
+    // There has to be a char between the whitespace,
+    // otherwise iter would be equal to end_iter, so
+    // we can just go until we find that char.
+    while (((the_char = *end_iter)== '\n') ||
+           (the_char == '\t') ||
+           (the_char == '\r') ||
+           (the_char == '\b')) {
+      --end_iter;
+    }
+
+    ++end_iter; // Step beond the last character we want in the value.
+  }
 
   // end_iter should point to the char after the last to copy
-  aResult = Substring(iter, ++end_iter);
+  return Substring(iter, end_iter);
 }
 
 nsresult
@@ -785,8 +783,17 @@ HTMLContentSink::AddAttributes(const nsIParserNode& aNode,
                                nsIHTMLContent* aContent, PRBool aNotify)
 {
   // Add tag attributes to the content attributes
-  nsAutoString k, v;
+
   PRInt32 ac = aNode.GetAttributeCount();
+
+  if (ac == 0) {
+    // No attributes, nothing to do. Do an early return to avoid
+    // constructing the nsAutoString object for nothing.
+
+    return NS_OK;
+  }
+
+  nsAutoString k;
   nsHTMLTag nodeType = nsHTMLTag(aNode.GetNodeType());
 
   for (PRInt32 i = 0; i < ac; i++) {
@@ -795,25 +802,28 @@ HTMLContentSink::AddAttributes(const nsIParserNode& aNode,
     k.Assign(key);
     k.ToLowerCase();
 
-    nsIAtom*  keyAtom = NS_NewAtom(k);
+    nsCOMPtr<nsIAtom>  keyAtom(dont_AddRef(NS_NewAtom(k)));
     nsHTMLValue value;
 
     if (NS_CONTENT_ATTR_NOT_THERE == 
         aContent->GetHTMLAttribute(keyAtom, value)) {
       // Get value and remove mandatory quotes
-      GetAttributeValueAt(aNode, i, v);
+      const nsAString& v = GetAttributeValueAt(aNode, i);
 
       if (nodeType == eHTMLTag_a && keyAtom == nsHTMLAtoms::name) {
         NS_ConvertUCS2toUTF8 cname(v);
-        v.Assign(NS_ConvertUTF8toUCS2(nsUnescape(NS_CONST_CAST(char *,
-                                                               cname.get()))));
-      }
+        NS_ConvertUTF8toUCS2 uv(nsUnescape(NS_CONST_CAST(char *,
+                                                         cname.get())));
 
-      // Add attribute to content
-      aContent->SetAttr(kNameSpaceID_HTML, keyAtom, v, aNotify);
+        // Add attribute to content
+        aContent->SetAttr(kNameSpaceID_HTML, keyAtom, uv, aNotify);
+      } else {
+        // Add attribute to content
+        aContent->SetAttr(kNameSpaceID_HTML, keyAtom, v, aNotify);
+      }
     }
-    NS_RELEASE(keyAtom);
   }
+
   return NS_OK;
 }