diff --git a/dom/src/base/nsDOMClassInfo.cpp b/dom/src/base/nsDOMClassInfo.cpp
index cdf00a60b7b..a77213d3e03 100644
--- a/dom/src/base/nsDOMClassInfo.cpp
+++ b/dom/src/base/nsDOMClassInfo.cpp
@@ -6564,8 +6564,9 @@ nsWindowSH::InnerObject(nsIXPConnectWrappedNative *wrapper, JSContext * cx,
 {
   nsGlobalWindow *win = nsGlobalWindow::FromWrapper(wrapper);
 
-  if (win->IsInnerWindow()) {
-    // Return the inner window.
+  if (win->IsInnerWindow() || win->IsFrozen()) {
+    // Return the inner window, or the outer if we're dealing with a
+    // frozen outer.
 
     *_retval = obj;
   } else {
diff --git a/dom/src/base/nsGlobalWindow.cpp b/dom/src/base/nsGlobalWindow.cpp
index 828699ab2df..59e6f3dea41 100644
--- a/dom/src/base/nsGlobalWindow.cpp
+++ b/dom/src/base/nsGlobalWindow.cpp
@@ -408,7 +408,7 @@ nsGlobalWindow::nsGlobalWindow(nsGlobalWindow *aOuterWindow)
 
   if (aOuterWindow) {
     // |this| is an inner window, add this inner window to the outer
-    // |window list of inners.
+    // window list of inners.
     PR_INSERT_AFTER(this, aOuterWindow);
 
     mObserver = new nsGlobalWindowObserver(this);
@@ -428,6 +428,11 @@ nsGlobalWindow::nsGlobalWindow(nsGlobalWindow *aOuterWindow)
       }
     }
   } else {
+    // |this| is an outer window. Outer windows start out frozen and
+    // remain frozen until they get an inner window, so freeze this
+    // outer window here.
+    Freeze();
+
     mObserver = nsnull;
   }
 
@@ -1106,6 +1111,13 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
   }
 #endif
 
+  if (IsOuterWindow() && IsFrozen()) {
+    // This outer is now getting its first inner, thaw the outer now
+    // that it's ready and is getting an inner window.
+
+    Thaw();
+  }
+
   if (!aIsInternalCall && IsInnerWindow()) {
     if (!mOuterWindow) {
       return NS_ERROR_NOT_INITIALIZED;
@@ -5907,7 +5919,7 @@ nsGlobalWindow::Observe(nsISupports* aSubject, const char* aTopic,
 
     nsAutoString domain(aData);
 
-    if (mIsFrozen) {
+    if (IsFrozen()) {
       // This window is frozen, rather than firing the events here,
       // store the domain in which the change happened and fire the
       // events if we're ever thawed.
diff --git a/js/src/jsobj.c b/js/src/jsobj.c
index 8b9bd548e93..a6a2beb8e6d 100644
--- a/js/src/jsobj.c
+++ b/js/src/jsobj.c
@@ -2529,6 +2529,10 @@ js_FindClassObject(JSContext *cx, JSObject *start, jsid id, jsval *vp)
         }
     }
 
+    OBJ_TO_INNER_OBJECT(cx, obj);
+    if (!obj)
+        return JS_FALSE;
+
     if (JSID_IS_INT(id)) {
         key = JSID_TO_INT(id);
         JS_ASSERT(key != JSProto_Null);