diff --git a/mozilla/htmlparser/src/CNavDTD.cpp b/mozilla/htmlparser/src/CNavDTD.cpp
index 6aec06b1b39..d2eb0999ce7 100644
--- a/mozilla/htmlparser/src/CNavDTD.cpp
+++ b/mozilla/htmlparser/src/CNavDTD.cpp
@@ -913,7 +913,7 @@ nsresult CNavDTD::HandleToken(CToken* aToken,nsIParser* aParser){
         eHTMLTags theParentTag=mBodyContext->Last();
         theTag=(eHTMLTags)theToken->GetTypeID();
         if((FindTagInSet(theTag,gLegalElements,sizeof(gLegalElements)/sizeof(theTag))) ||
-          (gHTMLElements[theParentTag].CanContain(theTag)) && (theTag!=eHTMLTag_comment)) { // Added comment -> bug 40855
+          (gHTMLElements[theParentTag].CanContain(theTag,mDTDMode)) && (theTag!=eHTMLTag_comment)) { // Added comment -> bug 40855
             
           mFlags &= ~NS_DTD_FLAG_MISPLACED_CONTENT; // reset the state since all the misplaced tokens are about to get handled.
 
@@ -1890,7 +1890,7 @@ PRBool HasCloseablePeerAboveRoot(const TagList& aRootTagList,nsDTDContext& aCont
  *  @return  PR_TRUE if autoclosure should occur
  */ 
 static
-eHTMLTags FindAutoCloseTargetForEndTag(eHTMLTags aCurrentTag,nsDTDContext& aContext) {
+eHTMLTags FindAutoCloseTargetForEndTag(eHTMLTags aCurrentTag,nsDTDContext& aContext,nsDTDMode aMode) {
   int theTopIndex=aContext.GetCount();
   eHTMLTags thePrevTag=aContext.Last();
  
@@ -1949,7 +1949,7 @@ eHTMLTags FindAutoCloseTargetForEndTag(eHTMLTags aCurrentTag,nsDTDContext& aCont
       else{
         //Ok, a much more sensible approach for non-block closers; use the tag group to determine closure:
         //For example: %phrasal closes %phrasal, %fontstyle and %special
-        return gHTMLElements[aCurrentTag].GetCloseTargetForEndTag(aContext,theChildIndex);
+        return gHTMLElements[aCurrentTag].GetCloseTargetForEndTag(aContext,theChildIndex,aMode);
       }
     }//if
   } //if
@@ -2086,7 +2086,7 @@ nsresult CNavDTD::HandleEndToken(CToken* aToken) {
             return result;
           }
           if(result==NS_OK) {
-            eHTMLTags theTarget=FindAutoCloseTargetForEndTag(theChildTag,*mBodyContext);
+            eHTMLTags theTarget=FindAutoCloseTargetForEndTag(theChildTag,*mBodyContext,mDTDMode);
             if(eHTMLTag_unknown!=theTarget) {
               if (nsHTMLElement::IsResidualStyleTag(theChildTag)) {
                 result=OpenTransientStyles(theChildTag); 
@@ -2533,7 +2533,7 @@ CNavDTD::CollectSkippedContent(PRInt32 aTag, nsAString& aContent, PRInt32 &aLine
  */
 PRBool CNavDTD::CanContain(PRInt32 aParent,PRInt32 aChild) const 
 {
-  PRBool result=gHTMLElements[aParent].CanContain((eHTMLTags)aChild);
+  PRBool result=gHTMLElements[aParent].CanContain((eHTMLTags)aChild,mDTDMode);
 
 #ifdef ALLOW_TR_AS_CHILD_OF_TABLE
   if(!result) {
@@ -2741,7 +2741,7 @@ PRBool CNavDTD::CanOmit(eHTMLTags aParent,eHTMLTags aChild,PRBool& aParentContai
 
     if(-1==aParentContains) {    
       //we need to compute parent containment here, since it wasn't given...
-      if(!gHTMLElements[aParent].CanContain(aChild)){
+      if(!gHTMLElements[aParent].CanContain(aChild,mDTDMode)){
         return PR_TRUE;
       }
     }
@@ -2958,7 +2958,7 @@ nsresult CNavDTD::OpenTransientStyles(eHTMLTags aChildTag){
             nsCParserNode* theNode=(nsCParserNode*)theEntry->mNode;
             if(1==theNode->mUseCount) {
               eHTMLTags theNodeTag=(eHTMLTags)theNode->GetNodeType();
-              if(gHTMLElements[theNodeTag].CanContain(aChildTag)) {
+              if(gHTMLElements[theNodeTag].CanContain(aChildTag,mDTDMode)) {
                 theEntry->mParent = theStack;  //we do this too, because this entry differs from the new one we're pushing...
                 if(gHTMLElements[mBodyContext->Last()].IsMemberOf(kHeading)) {
                   // Bug 77352
diff --git a/mozilla/htmlparser/src/nsElementTable.cpp b/mozilla/htmlparser/src/nsElementTable.cpp
index d717ea7baae..f200ecd444d 100644
--- a/mozilla/htmlparser/src/nsElementTable.cpp
+++ b/mozilla/htmlparser/src/nsElementTable.cpp
@@ -70,7 +70,8 @@ DECL_TAG_LIST(gInDL,{eHTMLTag_dl COMMA eHTMLTag_body})
 DECL_TAG_LIST(gInFrameset,{eHTMLTag_frameset})
 DECL_TAG_LIST(gInNoframes,{eHTMLTag_noframes})
 //Removed ADDRESS to solve 24885
-DECL_TAG_LIST(gInP,{eHTMLTag_span COMMA eHTMLTag_table}) // added table for bug 43678, removed FORM bug 94269
+// gInP: nsHTMLElement::CanContain() also allows table in Quirks mode for bug 43678, removed FORM bug 94269
+DECL_TAG_LIST(gInP,{eHTMLTag_span})
 DECL_TAG_LIST(gOptgroupParents,{eHTMLTag_select COMMA eHTMLTag_optgroup})
 DECL_TAG_LIST(gBodyParents,{eHTMLTag_html COMMA eHTMLTag_noframes})
 DECL_TAG_LIST(gColParents,{eHTMLTag_table COMMA eHTMLTag_colgroup})
@@ -1729,10 +1730,10 @@ PRBool nsHTMLElement::IsSectionTag(eHTMLTags aTag){
  * @param 
  * @return
  */
-PRBool nsHTMLElement::CanContain(eHTMLTags aParent,eHTMLTags aChild){
+PRBool nsHTMLElement::CanContain(eHTMLTags aParent,eHTMLTags aChild,nsDTDMode aMode){
   PRBool result=PR_FALSE;
   if((aParent>=eHTMLTag_unknown) & (aParent<=eHTMLTag_userdefined)){
-    result=gHTMLElements[aParent].CanContain(aChild);
+    result=gHTMLElements[aParent].CanContain(aChild,aMode);
   } 
   return result;
 }
@@ -2071,7 +2072,7 @@ PRBool nsHTMLElement::CanAutoCloseTag(nsDTDContext& aContext,eHTMLTags aChildTag
  * @param 
  * @return  
  */
-eHTMLTags nsHTMLElement::GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32 anIndex) const{
+eHTMLTags nsHTMLElement::GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32 anIndex,nsDTDMode aMode) const{
   eHTMLTags result=eHTMLTag_unknown;
 
   int theCount=aContext.GetCount();
@@ -2143,7 +2144,7 @@ eHTMLTags nsHTMLElement::GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32
     while((--theIndex>=anIndex) && (eHTMLTag_unknown==result)){
       eHTMLTags theTag=aContext.TagAt(theIndex);
       if(theTag!=mTagID) {
-        if(!CanContain(theTag)) {
+        if(!CanContain(theTag,aMode)) {
           break; //it's not something I can close
         }
       }
@@ -2159,7 +2160,7 @@ eHTMLTags nsHTMLElement::GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32
     while((--theIndex>=anIndex) && (eHTMLTag_unknown==result)){
       eHTMLTags theTag=aContext.TagAt(theIndex);
       if(theTag!=mTagID) {
-        if(!CanContain(theTag)) {
+        if(!CanContain(theTag,aMode)) {
           break; //it's not something I can close
         }
       }
@@ -2184,7 +2185,7 @@ eHTMLTags nsHTMLElement::GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32
       if(theTag == mTagID) {
         return theTag; // we found our target.
       }
-      else if (!CanContain(theTag) || 
+      else if (!CanContain(theTag,aMode) || 
                (theRootTags && FindTagInSet(theTag,theRootTags->mTags,theRootTags->mCount))) {
         // If you cannot contain this tag then
         // you cannot close it either. It looks like
@@ -2229,7 +2230,7 @@ eHTMLTags nsHTMLElement::GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32
  * @param 
  * @return
  */
-PRBool nsHTMLElement::CanContain(eHTMLTags aChild) const{
+PRBool nsHTMLElement::CanContain(eHTMLTags aChild,nsDTDMode aMode) const{
 
 
   if(IsContainer(mTagID)){
@@ -2292,6 +2293,10 @@ PRBool nsHTMLElement::CanContain(eHTMLTags aChild) const{
       }
     }
 
+    // Allow <p> to contain <table> only in Quirks mode, bug 43678 and bug 91927
+    if (aChild == eHTMLTag_table && mTagID == eHTMLTag_p && aMode == eDTDMode_quirks) {
+      return PR_TRUE;
+    }
   }
   
   return PR_FALSE;
diff --git a/mozilla/htmlparser/src/nsElementTable.h b/mozilla/htmlparser/src/nsElementTable.h
index 11cbf379d75..1f00883b4e9 100644
--- a/mozilla/htmlparser/src/nsElementTable.h
+++ b/mozilla/htmlparser/src/nsElementTable.h
@@ -200,7 +200,7 @@ struct nsHTMLElement {
   const TagList*  GetEndRootTags(void) const {return mEndRootNodes;}
   const TagList*  GetAutoCloseStartTags(void) const {return mAutocloseStart;}
   const TagList*  GetAutoCloseEndTags(void) const {return mAutocloseEnd;}
-  eHTMLTags       GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32 anIndex) const;
+  eHTMLTags       GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32 anIndex,nsDTDMode aMode) const;
 
   const TagList*        GetSpecialChildren(void) const {return mSpecialKids;}
   const TagList*        GetSpecialParents(void) const {return mSpecialParents;}
@@ -210,7 +210,7 @@ struct nsHTMLElement {
   PRBool          CanContainType(PRInt32 aType) const;
   
   eHTMLTags       GetTag(void) const {return mTagID;}
-  PRBool          CanContain(eHTMLTags aChild) const;
+  PRBool          CanContain(eHTMLTags aChild,nsDTDMode aMode) const;
   PRBool          CanExclude(eHTMLTags aChild) const;
   PRBool          CanOmitStartTag(eHTMLTags aChild) const;
   PRBool          CanOmitEndTag(void) const;
@@ -224,7 +224,7 @@ struct nsHTMLElement {
 
   PRBool          CanBeContained(eHTMLTags aParentTag,nsDTDContext &aContext); //default version
 
-  static  PRBool  CanContain(eHTMLTags aParent,eHTMLTags aChild);
+  static  PRBool  CanContain(eHTMLTags aParent,eHTMLTags aChild,nsDTDMode aMode);
   static  PRBool  IsContainer(eHTMLTags aTag) ;
   static  PRBool  IsResidualStyleTag(eHTMLTags aTag) ;
   static  PRBool  IsTextTag(eHTMLTags aTag);
diff --git a/mozilla/parser/htmlparser/src/CNavDTD.cpp b/mozilla/parser/htmlparser/src/CNavDTD.cpp
index 6aec06b1b39..d2eb0999ce7 100644
--- a/mozilla/parser/htmlparser/src/CNavDTD.cpp
+++ b/mozilla/parser/htmlparser/src/CNavDTD.cpp
@@ -913,7 +913,7 @@ nsresult CNavDTD::HandleToken(CToken* aToken,nsIParser* aParser){
         eHTMLTags theParentTag=mBodyContext->Last();
         theTag=(eHTMLTags)theToken->GetTypeID();
         if((FindTagInSet(theTag,gLegalElements,sizeof(gLegalElements)/sizeof(theTag))) ||
-          (gHTMLElements[theParentTag].CanContain(theTag)) && (theTag!=eHTMLTag_comment)) { // Added comment -> bug 40855
+          (gHTMLElements[theParentTag].CanContain(theTag,mDTDMode)) && (theTag!=eHTMLTag_comment)) { // Added comment -> bug 40855
             
           mFlags &= ~NS_DTD_FLAG_MISPLACED_CONTENT; // reset the state since all the misplaced tokens are about to get handled.
 
@@ -1890,7 +1890,7 @@ PRBool HasCloseablePeerAboveRoot(const TagList& aRootTagList,nsDTDContext& aCont
  *  @return  PR_TRUE if autoclosure should occur
  */ 
 static
-eHTMLTags FindAutoCloseTargetForEndTag(eHTMLTags aCurrentTag,nsDTDContext& aContext) {
+eHTMLTags FindAutoCloseTargetForEndTag(eHTMLTags aCurrentTag,nsDTDContext& aContext,nsDTDMode aMode) {
   int theTopIndex=aContext.GetCount();
   eHTMLTags thePrevTag=aContext.Last();
  
@@ -1949,7 +1949,7 @@ eHTMLTags FindAutoCloseTargetForEndTag(eHTMLTags aCurrentTag,nsDTDContext& aCont
       else{
         //Ok, a much more sensible approach for non-block closers; use the tag group to determine closure:
         //For example: %phrasal closes %phrasal, %fontstyle and %special
-        return gHTMLElements[aCurrentTag].GetCloseTargetForEndTag(aContext,theChildIndex);
+        return gHTMLElements[aCurrentTag].GetCloseTargetForEndTag(aContext,theChildIndex,aMode);
       }
     }//if
   } //if
@@ -2086,7 +2086,7 @@ nsresult CNavDTD::HandleEndToken(CToken* aToken) {
             return result;
           }
           if(result==NS_OK) {
-            eHTMLTags theTarget=FindAutoCloseTargetForEndTag(theChildTag,*mBodyContext);
+            eHTMLTags theTarget=FindAutoCloseTargetForEndTag(theChildTag,*mBodyContext,mDTDMode);
             if(eHTMLTag_unknown!=theTarget) {
               if (nsHTMLElement::IsResidualStyleTag(theChildTag)) {
                 result=OpenTransientStyles(theChildTag); 
@@ -2533,7 +2533,7 @@ CNavDTD::CollectSkippedContent(PRInt32 aTag, nsAString& aContent, PRInt32 &aLine
  */
 PRBool CNavDTD::CanContain(PRInt32 aParent,PRInt32 aChild) const 
 {
-  PRBool result=gHTMLElements[aParent].CanContain((eHTMLTags)aChild);
+  PRBool result=gHTMLElements[aParent].CanContain((eHTMLTags)aChild,mDTDMode);
 
 #ifdef ALLOW_TR_AS_CHILD_OF_TABLE
   if(!result) {
@@ -2741,7 +2741,7 @@ PRBool CNavDTD::CanOmit(eHTMLTags aParent,eHTMLTags aChild,PRBool& aParentContai
 
     if(-1==aParentContains) {    
       //we need to compute parent containment here, since it wasn't given...
-      if(!gHTMLElements[aParent].CanContain(aChild)){
+      if(!gHTMLElements[aParent].CanContain(aChild,mDTDMode)){
         return PR_TRUE;
       }
     }
@@ -2958,7 +2958,7 @@ nsresult CNavDTD::OpenTransientStyles(eHTMLTags aChildTag){
             nsCParserNode* theNode=(nsCParserNode*)theEntry->mNode;
             if(1==theNode->mUseCount) {
               eHTMLTags theNodeTag=(eHTMLTags)theNode->GetNodeType();
-              if(gHTMLElements[theNodeTag].CanContain(aChildTag)) {
+              if(gHTMLElements[theNodeTag].CanContain(aChildTag,mDTDMode)) {
                 theEntry->mParent = theStack;  //we do this too, because this entry differs from the new one we're pushing...
                 if(gHTMLElements[mBodyContext->Last()].IsMemberOf(kHeading)) {
                   // Bug 77352
diff --git a/mozilla/parser/htmlparser/src/nsElementTable.cpp b/mozilla/parser/htmlparser/src/nsElementTable.cpp
index d717ea7baae..f200ecd444d 100644
--- a/mozilla/parser/htmlparser/src/nsElementTable.cpp
+++ b/mozilla/parser/htmlparser/src/nsElementTable.cpp
@@ -70,7 +70,8 @@ DECL_TAG_LIST(gInDL,{eHTMLTag_dl COMMA eHTMLTag_body})
 DECL_TAG_LIST(gInFrameset,{eHTMLTag_frameset})
 DECL_TAG_LIST(gInNoframes,{eHTMLTag_noframes})
 //Removed ADDRESS to solve 24885
-DECL_TAG_LIST(gInP,{eHTMLTag_span COMMA eHTMLTag_table}) // added table for bug 43678, removed FORM bug 94269
+// gInP: nsHTMLElement::CanContain() also allows table in Quirks mode for bug 43678, removed FORM bug 94269
+DECL_TAG_LIST(gInP,{eHTMLTag_span})
 DECL_TAG_LIST(gOptgroupParents,{eHTMLTag_select COMMA eHTMLTag_optgroup})
 DECL_TAG_LIST(gBodyParents,{eHTMLTag_html COMMA eHTMLTag_noframes})
 DECL_TAG_LIST(gColParents,{eHTMLTag_table COMMA eHTMLTag_colgroup})
@@ -1729,10 +1730,10 @@ PRBool nsHTMLElement::IsSectionTag(eHTMLTags aTag){
  * @param 
  * @return
  */
-PRBool nsHTMLElement::CanContain(eHTMLTags aParent,eHTMLTags aChild){
+PRBool nsHTMLElement::CanContain(eHTMLTags aParent,eHTMLTags aChild,nsDTDMode aMode){
   PRBool result=PR_FALSE;
   if((aParent>=eHTMLTag_unknown) & (aParent<=eHTMLTag_userdefined)){
-    result=gHTMLElements[aParent].CanContain(aChild);
+    result=gHTMLElements[aParent].CanContain(aChild,aMode);
   } 
   return result;
 }
@@ -2071,7 +2072,7 @@ PRBool nsHTMLElement::CanAutoCloseTag(nsDTDContext& aContext,eHTMLTags aChildTag
  * @param 
  * @return  
  */
-eHTMLTags nsHTMLElement::GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32 anIndex) const{
+eHTMLTags nsHTMLElement::GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32 anIndex,nsDTDMode aMode) const{
   eHTMLTags result=eHTMLTag_unknown;
 
   int theCount=aContext.GetCount();
@@ -2143,7 +2144,7 @@ eHTMLTags nsHTMLElement::GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32
     while((--theIndex>=anIndex) && (eHTMLTag_unknown==result)){
       eHTMLTags theTag=aContext.TagAt(theIndex);
       if(theTag!=mTagID) {
-        if(!CanContain(theTag)) {
+        if(!CanContain(theTag,aMode)) {
           break; //it's not something I can close
         }
       }
@@ -2159,7 +2160,7 @@ eHTMLTags nsHTMLElement::GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32
     while((--theIndex>=anIndex) && (eHTMLTag_unknown==result)){
       eHTMLTags theTag=aContext.TagAt(theIndex);
       if(theTag!=mTagID) {
-        if(!CanContain(theTag)) {
+        if(!CanContain(theTag,aMode)) {
           break; //it's not something I can close
         }
       }
@@ -2184,7 +2185,7 @@ eHTMLTags nsHTMLElement::GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32
       if(theTag == mTagID) {
         return theTag; // we found our target.
       }
-      else if (!CanContain(theTag) || 
+      else if (!CanContain(theTag,aMode) || 
                (theRootTags && FindTagInSet(theTag,theRootTags->mTags,theRootTags->mCount))) {
         // If you cannot contain this tag then
         // you cannot close it either. It looks like
@@ -2229,7 +2230,7 @@ eHTMLTags nsHTMLElement::GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32
  * @param 
  * @return
  */
-PRBool nsHTMLElement::CanContain(eHTMLTags aChild) const{
+PRBool nsHTMLElement::CanContain(eHTMLTags aChild,nsDTDMode aMode) const{
 
 
   if(IsContainer(mTagID)){
@@ -2292,6 +2293,10 @@ PRBool nsHTMLElement::CanContain(eHTMLTags aChild) const{
       }
     }
 
+    // Allow <p> to contain <table> only in Quirks mode, bug 43678 and bug 91927
+    if (aChild == eHTMLTag_table && mTagID == eHTMLTag_p && aMode == eDTDMode_quirks) {
+      return PR_TRUE;
+    }
   }
   
   return PR_FALSE;
diff --git a/mozilla/parser/htmlparser/src/nsElementTable.h b/mozilla/parser/htmlparser/src/nsElementTable.h
index 11cbf379d75..1f00883b4e9 100644
--- a/mozilla/parser/htmlparser/src/nsElementTable.h
+++ b/mozilla/parser/htmlparser/src/nsElementTable.h
@@ -200,7 +200,7 @@ struct nsHTMLElement {
   const TagList*  GetEndRootTags(void) const {return mEndRootNodes;}
   const TagList*  GetAutoCloseStartTags(void) const {return mAutocloseStart;}
   const TagList*  GetAutoCloseEndTags(void) const {return mAutocloseEnd;}
-  eHTMLTags       GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32 anIndex) const;
+  eHTMLTags       GetCloseTargetForEndTag(nsDTDContext& aContext,PRInt32 anIndex,nsDTDMode aMode) const;
 
   const TagList*        GetSpecialChildren(void) const {return mSpecialKids;}
   const TagList*        GetSpecialParents(void) const {return mSpecialParents;}
@@ -210,7 +210,7 @@ struct nsHTMLElement {
   PRBool          CanContainType(PRInt32 aType) const;
   
   eHTMLTags       GetTag(void) const {return mTagID;}
-  PRBool          CanContain(eHTMLTags aChild) const;
+  PRBool          CanContain(eHTMLTags aChild,nsDTDMode aMode) const;
   PRBool          CanExclude(eHTMLTags aChild) const;
   PRBool          CanOmitStartTag(eHTMLTags aChild) const;
   PRBool          CanOmitEndTag(void) const;
@@ -224,7 +224,7 @@ struct nsHTMLElement {
 
   PRBool          CanBeContained(eHTMLTags aParentTag,nsDTDContext &aContext); //default version
 
-  static  PRBool  CanContain(eHTMLTags aParent,eHTMLTags aChild);
+  static  PRBool  CanContain(eHTMLTags aParent,eHTMLTags aChild,nsDTDMode aMode);
   static  PRBool  IsContainer(eHTMLTags aTag) ;
   static  PRBool  IsResidualStyleTag(eHTMLTags aTag) ;
   static  PRBool  IsTextTag(eHTMLTags aTag);