diff --git a/parser/htmlparser/src/nsHTMLTokenizer.cpp b/parser/htmlparser/src/nsHTMLTokenizer.cpp
index 3732b6893853..5d68999dea71 100644
--- a/parser/htmlparser/src/nsHTMLTokenizer.cpp
+++ b/parser/htmlparser/src/nsHTMLTokenizer.cpp
@@ -426,15 +426,23 @@ nsresult nsHTMLTokenizer::ScanDocStructure(PRBool aFinalChunk)
                 PRInt32 earlyPos = FindLastIndexOfTag(theTag, theStack);
                 if (earlyPos != kNotFound) {
                   // Uh-oh, we've found a tag that is not allowed to nest at
-                  // all. Mark the previous one as malformed to increase our
-                  // chances of doing RS handling on it. We want to do this
-                  // for cases such as: <a><div><a></a></div></a>.
+                  // all. Mark the previous one and all of its children as 
+                  // malformed to increase our chances of doing RS handling
+                  // on all of them. We want to do this for cases such as:
+                  // <a><div><a></a></div></a>.
+                  // Note that we have to iterate through all of the chilren
+                  // of the original malformed tag to protect against:
+                  // <a><font><div><a></a></div></font></a>, so that the <font>
+                  // is allowed to contain the <div>.
                   // XXX What about <a><span><a>, where the second <a> closes
                   // the <span>?
-                  CHTMLToken *theMalformedToken = 
-                    NS_STATIC_CAST(CHTMLToken*, theStack.ObjectAt(earlyPos));
+                  nsDequeIterator it(theStack, earlyPos), end(theStack.End());
+                  while (it < end) {
+                    CHTMLToken *theMalformedToken = 
+                        NS_STATIC_CAST(CHTMLToken*, it++);
                   
-                  theMalformedToken->SetContainerInfo(eMalformed);
+                    theMalformedToken->SetContainerInfo(eMalformed);
+                  }
                 }
               }
 
diff --git a/xpcom/build/dlldeps.cpp b/xpcom/build/dlldeps.cpp
index 73c0200ea8ba..6b4656044d08 100644
--- a/xpcom/build/dlldeps.cpp
+++ b/xpcom/build/dlldeps.cpp
@@ -128,6 +128,7 @@ void XXXNeverCalled()
     a.Free(0, 0);
     nsIThread::GetCurrent(nsnull);
     nsDeque(nsnull);
+    nsDequeIterator(nsDeque());
     nsTraceRefcnt::LogAddCOMPtr(nsnull, nsnull);
     nsTraceRefcntImpl::DumpStatistics();
     NS_NewEmptyEnumerator(nsnull);
diff --git a/xpcom/ds/nsDeque.h b/xpcom/ds/nsDeque.h
index 7fdf7465347e..def350e1dc12 100644
--- a/xpcom/ds/nsDeque.h
+++ b/xpcom/ds/nsDeque.h
@@ -245,7 +245,7 @@ private:
  * Here comes the nsDequeIterator class...
  ******************************************************/
 
-class nsDequeIterator {
+class NS_COM nsDequeIterator {
 public:
   /**
    * DequeIterator is an object that knows how to iterate