diff --git a/mozilla/lib/libdom/dom.h b/mozilla/lib/libdom/dom.h
index 114274330bc..c1f7cb22690 100644
--- a/mozilla/lib/libdom/dom.h
+++ b/mozilla/lib/libdom/dom.h
@@ -209,16 +209,29 @@ DOM_PopNode(DOM_Node *node);
  * data is for use by the underlying embedding, to keep it from having to parse
  * "value" every time.  Dirty is set to true when a set operation happens
  * through the DOM interface, and the embedding can key on that to reparse
- * "value", and reset data and dirty.
+ * "value", and reset data and dirty.  The "dtor" is called when the entry
+ * is destroyed.  It should return JS_TRUE if it's OK to free the entry, and
+ * JS_FALSE otherwise.
  */
 
+struct DOM_AttributeEntry;      /* forward decl */
+
+typedef JSBool(*DOM_DataParser)(const char *str, uint32 *data, void *closure);
+typedef JSBool(*DOM_DataDestructor)(DOM_AttributeEntry *entry);
+
 struct DOM_AttributeEntry {
     const char *name;
     const char *value;
     uint32 data;
     JSBool dirty;
+    DOM_DataDestructor dtor;
 };
 
+JSBool
+DOM_GetCleanEntryData(JSContext *cx, DOM_AttributeEntry *entry,
+                      DOM_DataParser parser, DOM_DataDestructor dtor,
+                      uint32 *data, void *closure);
+
 struct DOM_Element {
     DOM_Node            node;
     DOM_ElementOps      *ops;
@@ -252,11 +265,6 @@ JSBool
 DOM_SetElementAttribute(JSContext *cx, DOM_Element *element, const char *name,
                         const char *value);
 
-typedef JSBool(*DOM_DataParser)(const char *str, uint32 *data, void *closure);
-
-JSBool
-DOM_GetCleanEntryData(JSContext *cx, DOM_AttributeEntry *entry,
-                      DOM_DataParser parser, uint32 *data, void *closure);
 
 /*
  * Set the attributes from a pair of synchronized lists.
diff --git a/mozilla/lib/libdom/domelement.c b/mozilla/lib/libdom/domelement.c
index c8b90babb32..44f3ec494bf 100644
--- a/mozilla/lib/libdom/domelement.c
+++ b/mozilla/lib/libdom/domelement.c
@@ -239,9 +239,11 @@ DestroyAttrs(JSContext *cx, DOM_Element *element)
     DOM_AttributeEntry *entry;
     for (i = 0; i < element->nattrs; i++) {
         entry = element->attrs + i;
-        JS_free(cx, (char *)entry->name);
-        JS_free(cx, (char *)entry->value);
-        JS_free(cx, entry);
+        if (!entry->dtor || entry->dtor(entry)) {
+            JS_free(cx, (char *)entry->name);
+            JS_free(cx, (char *)entry->value);
+            JS_free(cx, entry);
+        }
     }
     JS_free(cx, element->attrs);
     element->attrs = NULL;
@@ -300,12 +302,14 @@ DOM_GetElementAttribute(JSContext *cx, DOM_Element *element, const char *name,
 
 JSBool
 DOM_GetCleanEntryData(JSContext *cx, DOM_AttributeEntry *entry,
-                      DOM_DataParser parser, uint32 *data, void *closure)
+                      DOM_DataParser parser, DOM_DataDestructor dtor,
+                      uint32 *data, void *closure)
 {
     if (entry->dirty) {
         uint32 newdata;
         if (!parser(entry->value, &newdata, closure))
             return JS_FALSE;
+        entry->dtor = dtor;
         entry->data = newdata;
         entry->dirty = JS_FALSE;
     }