diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 6d91f1fe0157..a033370447b9 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -4448,10 +4448,24 @@ PresShell::ContentAppended(nsIDocument *aDocument,
     // If history state has been set by session history, ask the frame manager 
     // to restore frame state for the frame hierarchy created for the chunk of
     // content that just came in.
-    nsIFrame* frame;
-    rv = GetPrimaryFrameFor(aContainer, &frame);
-    if (NS_SUCCEEDED(rv) && nsnull != frame)
-      mFrameManager->RestoreFrameState(mPresContext, frame, mHistoryState);
+    // That is the frames with numbers after aNewIndexInContainer.
+    PRInt32 count = 0;
+    aContainer->ChildCount(count);
+
+    PRInt32 i;
+    nsCOMPtr<nsIContent> newChild;
+    for (i = aNewIndexInContainer; i < count; ++i) {
+      aContainer->ChildAt(i, *getter_AddRefs(newChild));
+      if (!newChild) {
+        // We should never get here.
+        NS_ERROR("Got a null child when restoring state!");
+        continue;
+      }
+      nsIFrame* frame;
+      rv = GetPrimaryFrameFor(newChild, &frame);
+      if (NS_SUCCEEDED(rv) && nsnull != frame)
+        mFrameManager->RestoreFrameState(mPresContext, frame, mHistoryState);
+    }
   }
 
   MOZ_TIMER_DEBUGLOG(("Stop: Frame Creation: PresShell::ContentAppended(), this=%p\n", this));
diff --git a/layout/html/base/src/nsPresShell.cpp b/layout/html/base/src/nsPresShell.cpp
index 6d91f1fe0157..a033370447b9 100644
--- a/layout/html/base/src/nsPresShell.cpp
+++ b/layout/html/base/src/nsPresShell.cpp
@@ -4448,10 +4448,24 @@ PresShell::ContentAppended(nsIDocument *aDocument,
     // If history state has been set by session history, ask the frame manager 
     // to restore frame state for the frame hierarchy created for the chunk of
     // content that just came in.
-    nsIFrame* frame;
-    rv = GetPrimaryFrameFor(aContainer, &frame);
-    if (NS_SUCCEEDED(rv) && nsnull != frame)
-      mFrameManager->RestoreFrameState(mPresContext, frame, mHistoryState);
+    // That is the frames with numbers after aNewIndexInContainer.
+    PRInt32 count = 0;
+    aContainer->ChildCount(count);
+
+    PRInt32 i;
+    nsCOMPtr<nsIContent> newChild;
+    for (i = aNewIndexInContainer; i < count; ++i) {
+      aContainer->ChildAt(i, *getter_AddRefs(newChild));
+      if (!newChild) {
+        // We should never get here.
+        NS_ERROR("Got a null child when restoring state!");
+        continue;
+      }
+      nsIFrame* frame;
+      rv = GetPrimaryFrameFor(newChild, &frame);
+      if (NS_SUCCEEDED(rv) && nsnull != frame)
+        mFrameManager->RestoreFrameState(mPresContext, frame, mHistoryState);
+    }
   }
 
   MOZ_TIMER_DEBUGLOG(("Stop: Frame Creation: PresShell::ContentAppended(), this=%p\n", this));