diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 3489bab25500..f9d74e25b792 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -8049,7 +8049,8 @@ nsCSSFrameConstructor::FindPreviousSibling(nsIPresShell*     aPresShell,
   NS_ASSERTION(aPresShell && aContainer, "null arguments");
 
   ChildIterator first, iter;
-  ChildIterator::Init(aContainer, &first, &iter);
+  nsresult rv = ChildIterator::Init(aContainer, &first, &iter);
+  NS_ENSURE_SUCCESS(rv, nsnull);
   iter.seek(aIndexInContainer);
 
   PRUint8 childDisplay = UNSET_DISPLAY;
@@ -8115,7 +8116,8 @@ nsCSSFrameConstructor::FindNextSibling(nsIPresShell*     aPresShell,
                                        const nsIContent* aChild)
 {
   ChildIterator iter, last;
-  ChildIterator::Init(aContainer, &iter, &last);
+  nsresult rv = ChildIterator::Init(aContainer, &iter, &last);
+  NS_ENSURE_SUCCESS(rv, nsnull);
   iter.seek(aIndexInContainer);
 
   // Catch the case where someone tries to append
diff --git a/layout/base/nsChildIterator.cpp b/layout/base/nsChildIterator.cpp
index 7ae0a7a865b1..22e5de22630f 100644
--- a/layout/base/nsChildIterator.cpp
+++ b/layout/base/nsChildIterator.cpp
@@ -45,6 +45,10 @@ ChildIterator::Init(nsIContent*    aContent,
                     ChildIterator* aFirst,
                     ChildIterator* aLast)
 {
+  // Initialize out parameters to be equal, in case of failure.
+  aFirst->mContent = aLast->mContent = nsnull;
+  aFirst->mIndex   = aLast->mIndex   = 0;
+  
   NS_PRECONDITION(aContent != nsnull, "no content");
   if (! aContent)
     return NS_ERROR_NULL_POINTER;
diff --git a/layout/html/style/src/nsCSSFrameConstructor.cpp b/layout/html/style/src/nsCSSFrameConstructor.cpp
index 3489bab25500..f9d74e25b792 100644
--- a/layout/html/style/src/nsCSSFrameConstructor.cpp
+++ b/layout/html/style/src/nsCSSFrameConstructor.cpp
@@ -8049,7 +8049,8 @@ nsCSSFrameConstructor::FindPreviousSibling(nsIPresShell*     aPresShell,
   NS_ASSERTION(aPresShell && aContainer, "null arguments");
 
   ChildIterator first, iter;
-  ChildIterator::Init(aContainer, &first, &iter);
+  nsresult rv = ChildIterator::Init(aContainer, &first, &iter);
+  NS_ENSURE_SUCCESS(rv, nsnull);
   iter.seek(aIndexInContainer);
 
   PRUint8 childDisplay = UNSET_DISPLAY;
@@ -8115,7 +8116,8 @@ nsCSSFrameConstructor::FindNextSibling(nsIPresShell*     aPresShell,
                                        const nsIContent* aChild)
 {
   ChildIterator iter, last;
-  ChildIterator::Init(aContainer, &iter, &last);
+  nsresult rv = ChildIterator::Init(aContainer, &iter, &last);
+  NS_ENSURE_SUCCESS(rv, nsnull);
   iter.seek(aIndexInContainer);
 
   // Catch the case where someone tries to append
diff --git a/layout/html/style/src/nsChildIterator.cpp b/layout/html/style/src/nsChildIterator.cpp
index 7ae0a7a865b1..22e5de22630f 100644
--- a/layout/html/style/src/nsChildIterator.cpp
+++ b/layout/html/style/src/nsChildIterator.cpp
@@ -45,6 +45,10 @@ ChildIterator::Init(nsIContent*    aContent,
                     ChildIterator* aFirst,
                     ChildIterator* aLast)
 {
+  // Initialize out parameters to be equal, in case of failure.
+  aFirst->mContent = aLast->mContent = nsnull;
+  aFirst->mIndex   = aLast->mIndex   = 0;
+  
   NS_PRECONDITION(aContent != nsnull, "no content");
   if (! aContent)
     return NS_ERROR_NULL_POINTER;