diff --git a/mozilla/layout/html/base/src/nsPageFrame.cpp b/mozilla/layout/html/base/src/nsPageFrame.cpp
index 15dfb7df158..b0f87337731 100644
--- a/mozilla/layout/html/base/src/nsPageFrame.cpp
+++ b/mozilla/layout/html/base/src/nsPageFrame.cpp
@@ -263,11 +263,57 @@ GetUStr(const char * aCStr)
   return str.ToNewUnicode();
 }
 
+// Remove fix below when string gets fixed
+#define WORKAROUND_FOR_BUG_110335
 // replace the &<code> with the value, but if the value is empty
 // set the string to zero length
 static void
-SubstValueForCode(nsString& aStr, const PRUnichar * aUKey, const PRUnichar * aUStr)
+SubstValueForCode(nsString& aStr, PRUnichar * aUKey, PRUnichar * aUStr)
 {
+#ifdef WORKAROUND_FOR_BUG_110335
+  PRUnichar* uKeyStr = aUKey;
+
+  // Check to make sure our subst code &<code> isn't in the data string
+  // for example &T for title is in QB&T
+  nsAutoString dataStr(aUStr);
+  nsAutoString newKey(aUKey);
+  PRBool fixingSubstr = dataStr.Find(newKey) > -1;
+  if (fixingSubstr) {
+    // well, the code is in the data str so make up a new code
+    // but make sure it it isn't in either substs string or the data string
+    char* code = "~!@#$%^*()_+=][}{`';:|?/.,:\"<>";
+    PRInt32 codeInx = 0;
+    PRInt32 codeLen = PRUint32(strlen(code));
+    while ((dataStr.Find(newKey) > -1 || aStr.Find(newKey) > -1) && codeInx < codeLen) {
+      newKey.SetCharAt((PRUnichar)code[codeInx++], 0);
+    }
+
+    // Check to see if we can do the substitution
+    if (codeInx == codeLen) {
+      aStr.SetLength(0);
+      return; // bail we just can't do it
+    }
+
+    // Ok, we have the new code, so repplace the old code 
+    // in the dest str with the new code
+    nsAutoString oldKey(aUKey);
+    aStr.ReplaceSubstring(oldKey, newKey);
+    uKeyStr = newKey.ToNewUnicode();
+  }
+
+  nsAutoString str;
+  str = aUStr;
+  if (str.Length() == 0) {
+    aStr.SetLength(0);
+  } else {
+    aStr.ReplaceSubstring(uKeyStr, aUStr);
+  }
+
+  // Free uKeyStr only if we fixed the string.
+  if (fixingSubstr) {
+    nsMemory::Free(uKeyStr);
+  }
+#else
   nsAutoString str;
   str = aUStr;
   if (str.Length() == 0) {
@@ -275,6 +321,7 @@ SubstValueForCode(nsString& aStr, const PRUnichar * aUKey, const PRUnichar * aUS
   } else {
     aStr.ReplaceSubstring(aUKey, aUStr);
   }
+#endif  // WORKAROUND_FOR_BUG_110335
 }
 // done with static helper functions
 //------------------------------------------------------------------------------