diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
index 01bfc6e3af03..cf6e9e4f9289 100644
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -1831,15 +1831,20 @@ nsGenericElement::HandleDOMEvent(nsIPresContext* aPresContext,
     aFlags |= NS_EVENT_FLAG_BUBBLE | NS_EVENT_FLAG_CAPTURE;
   }
 
-  if (GetParent()) {
-    // Find out if we're anonymous.
-    if (*aDOMEvent) {
-      (*aDOMEvent)->GetTarget(getter_AddRefs(oldTarget));
-      nsCOMPtr<nsIContent> content(do_QueryInterface(oldTarget));
-      if (content && content->GetBindingParent() == GetParent())
+  // Find out whether we're anonymous.
+  if (IsNativeAnonymous()) {
+    retarget = PR_TRUE;
+  } else {
+    nsIContent* parent = GetParent();
+    if (parent) {
+      if (*aDOMEvent) {
+        (*aDOMEvent)->GetTarget(getter_AddRefs(oldTarget));
+        nsCOMPtr<nsIContent> content(do_QueryInterface(oldTarget));
+        if (content && content->GetBindingParent() == parent)
+          retarget = PR_TRUE;
+      } else if (GetBindingParent() == parent) {
         retarget = PR_TRUE;
-    } else if (GetBindingParent() == GetParent()) {
-      retarget = PR_TRUE;
+      }
     }
   }
 
diff --git a/content/xul/content/src/nsXULElement.cpp b/content/xul/content/src/nsXULElement.cpp
index 60e4324ba579..72e8fdd06057 100644
--- a/content/xul/content/src/nsXULElement.cpp
+++ b/content/xul/content/src/nsXULElement.cpp
@@ -2785,16 +2785,20 @@ nsXULElement::HandleDOMEvent(nsIPresContext* aPresContext, nsEvent* aEvent,
       return NS_OK; // Don't let these events bubble or be captured.  Just allow them
                     // on the target image.
 
-    if (GetParent()) {
-        // Find out if we're anonymous.
-        if (*aDOMEvent) {
-            (*aDOMEvent)->GetTarget(getter_AddRefs(oldTarget));
-            nsCOMPtr<nsIContent> content(do_QueryInterface(oldTarget));
-            if (content && content->GetBindingParent() == GetParent())
+    // Find out whether we're anonymous.
+    if (IsNativeAnonymous()) {
+        retarget = PR_TRUE;
+    } else {
+        nsIContent* parent = GetParent();
+        if (parent) {
+            if (*aDOMEvent) {
+                (*aDOMEvent)->GetTarget(getter_AddRefs(oldTarget));
+                nsCOMPtr<nsIContent> content(do_QueryInterface(oldTarget));
+                if (content && content->GetBindingParent() == parent)
+                    retarget = PR_TRUE;
+            } else if (GetBindingParent() == parent) {
                 retarget = PR_TRUE;
-        }
-        else if (GetBindingParent() == GetParent()) {
-            retarget = PR_TRUE;
+            }
         }
     }
 
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index a63d2fc4aaa8..f2c9a9274e19 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -1336,8 +1336,6 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIPresContext*       aPresContex
     nsINodeInfoManager *nimgr = aDocument->GetNodeInfoManager();
     NS_ENSURE_TRUE(nimgr, NS_ERROR_FAILURE);
 
-    // XXXldb We should not be creating an |image| element, because it
-    // matches selectors!  See bug 109216.
     nsCOMPtr<nsINodeInfo> nodeInfo;
     nimgr->GetNodeInfo(nsHTMLAtoms::img, nsnull, kNameSpaceID_None,
                        getter_AddRefs(nodeInfo));
@@ -1359,6 +1357,11 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIPresContext*       aPresContex
     // way event handling works
     content->SetParent(aContent);
     content->SetDocument(aDocument, PR_TRUE, PR_TRUE);
+    content->SetNativeAnonymous(PR_TRUE);
+    // hack to make document rules not match (not like it matters, since we
+    // already have a non-element style context... which is totally wacky, but
+    // anyway).
+    content->SetBindingParent(content);
   
     // Create an image frame and initialize it
     nsIFrame* imageFrame = nsnull;
@@ -1419,6 +1422,8 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIPresContext*       aPresContex
           // object. This way event handling works
           content->SetParent(aContent);
           content->SetDocument(aDocument, PR_TRUE, PR_TRUE);
+          content->SetNativeAnonymous(PR_TRUE);
+          content->SetBindingParent(content);
 
           // Create a text frame and initialize it
           NS_NewTextFrame(shell, &textFrame);
@@ -1486,6 +1491,8 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIPresContext*       aPresContex
       // way event handling works
       textContent->SetParent(aContent);
       textContent->SetDocument(aDocument, PR_TRUE, PR_TRUE);
+      textContent->SetNativeAnonymous(PR_TRUE);
+      textContent->SetBindingParent(textContent);
       
       // Create a text frame and initialize it
       NS_NewTextFrame(shell, &textFrame);
@@ -3554,6 +3561,9 @@ nsCSSFrameConstructor::ConstructRootFrame(nsIPresShell*        aPresShell,
   NS_NewViewportFrame(aPresShell, &viewportFrame);
 
 
+  // XXXbz do we _have_ to pass a null content pointer to that frame?
+  // Would it really kill us to pass in the root element or something?
+  // What would that break?
   viewportFrame->Init(aPresContext, nsnull, nsnull, viewportPseudoStyle, nsnull);
 
   // Bind the viewport frame to the root view
diff --git a/layout/html/style/src/nsCSSFrameConstructor.cpp b/layout/html/style/src/nsCSSFrameConstructor.cpp
index a63d2fc4aaa8..f2c9a9274e19 100644
--- a/layout/html/style/src/nsCSSFrameConstructor.cpp
+++ b/layout/html/style/src/nsCSSFrameConstructor.cpp
@@ -1336,8 +1336,6 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIPresContext*       aPresContex
     nsINodeInfoManager *nimgr = aDocument->GetNodeInfoManager();
     NS_ENSURE_TRUE(nimgr, NS_ERROR_FAILURE);
 
-    // XXXldb We should not be creating an |image| element, because it
-    // matches selectors!  See bug 109216.
     nsCOMPtr<nsINodeInfo> nodeInfo;
     nimgr->GetNodeInfo(nsHTMLAtoms::img, nsnull, kNameSpaceID_None,
                        getter_AddRefs(nodeInfo));
@@ -1359,6 +1357,11 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIPresContext*       aPresContex
     // way event handling works
     content->SetParent(aContent);
     content->SetDocument(aDocument, PR_TRUE, PR_TRUE);
+    content->SetNativeAnonymous(PR_TRUE);
+    // hack to make document rules not match (not like it matters, since we
+    // already have a non-element style context... which is totally wacky, but
+    // anyway).
+    content->SetBindingParent(content);
   
     // Create an image frame and initialize it
     nsIFrame* imageFrame = nsnull;
@@ -1419,6 +1422,8 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIPresContext*       aPresContex
           // object. This way event handling works
           content->SetParent(aContent);
           content->SetDocument(aDocument, PR_TRUE, PR_TRUE);
+          content->SetNativeAnonymous(PR_TRUE);
+          content->SetBindingParent(content);
 
           // Create a text frame and initialize it
           NS_NewTextFrame(shell, &textFrame);
@@ -1486,6 +1491,8 @@ nsCSSFrameConstructor::CreateGeneratedFrameFor(nsIPresContext*       aPresContex
       // way event handling works
       textContent->SetParent(aContent);
       textContent->SetDocument(aDocument, PR_TRUE, PR_TRUE);
+      textContent->SetNativeAnonymous(PR_TRUE);
+      textContent->SetBindingParent(textContent);
       
       // Create a text frame and initialize it
       NS_NewTextFrame(shell, &textFrame);
@@ -3554,6 +3561,9 @@ nsCSSFrameConstructor::ConstructRootFrame(nsIPresShell*        aPresShell,
   NS_NewViewportFrame(aPresShell, &viewportFrame);
 
 
+  // XXXbz do we _have_ to pass a null content pointer to that frame?
+  // Would it really kill us to pass in the root element or something?
+  // What would that break?
   viewportFrame->Init(aPresContext, nsnull, nsnull, viewportPseudoStyle, nsnull);
 
   // Bind the viewport frame to the root view