diff --git a/accessible/src/base/nsAccessibilityService.cpp b/accessible/src/base/nsAccessibilityService.cpp
index f07eb73c85f..a78c5a9bb3f 100644
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -216,7 +216,9 @@ NS_IMETHODIMP nsAccessibilityService::OnStateChange(nsIWebProgress *aWebProgress
   if (eventType == 0)
     return NS_OK; //no actural event need to be fired
 
-  docAccessible->FireDocLoadEvents(eventType);
+  if (docAccessible) {
+    docAccessible->FireDocLoadEvents(eventType);
+  }
 
   return NS_OK;
 }
@@ -1323,7 +1325,7 @@ NS_IMETHODIMP nsAccessibilityService::GetAccessible(nsIDOMNode *aNode,
 #endif
   if (!frame || content != frame->GetContent()) {
     // Frame hint not correct, get true frame, we try to optimize away from this
-    frame = aPresShell->GetPrimaryFrameFor(content);
+    frame = aPresShell->GetRealPrimaryFrameFor(content);
     if (frame) {
 #ifdef DEBUG_A11Y_FRAME_OPTIMIZATION
       // Frame hint debugging
@@ -1446,7 +1448,7 @@ NS_IMETHODIMP nsAccessibilityService::GetAccessible(nsIDOMNode *aNode,
             // Don't create accessibles for them unless they need to fire focus events
             return NS_OK;
           }
-          if (nsAccessible::Role(tableAccessible) != nsIAccessibleRole::ROLE_TABLE) {
+          if (tableAccessible && nsAccessible::Role(tableAccessible) != nsIAccessibleRole::ROLE_TABLE) {
             NS_ASSERTION(!roleMapEntry, "Should not be changing ARIA role, just overriding impl class role");
             roleMapEntry = &nsARIAMap::gLandmarkRoleMap; // Not in table: override role (roleMap entry was null)
           }
diff --git a/layout/base/nsIPresShell.h b/layout/base/nsIPresShell.h
index 54513bb4d98..ffd37c663c5 100644
--- a/layout/base/nsIPresShell.h
+++ b/layout/base/nsIPresShell.h
@@ -332,11 +332,19 @@ public:
    * being scrolled). The primary frame is always the first-in-flow.
    *
    * In the case of absolutely positioned elements and floated elements,
-   * the primary frame is the frame that is out of the flow and not the
-   * placeholder frame.
+   * the primary frame is the placeholder frame.
    */
   virtual NS_HIDDEN_(nsIFrame*) GetPrimaryFrameFor(nsIContent* aContent) const = 0;
 
+  /**
+   * Gets the real primary frame associated with the content object.
+   *
+   * In the case of absolutely positioned elements and floated elements,
+   * the real primary frame is the frame that is out of the flow and not the
+   * placeholder frame.
+   */
+  virtual NS_HIDDEN_(nsIFrame*) GetRealPrimaryFrameFor(nsIContent* aContent) const = 0;
+
   /**
    * Returns a layout object associated with the primary frame for the content object.
    *
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index e86dbe5a868..a24f6144ef2 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -808,6 +808,7 @@ public:
   NS_IMETHOD StyleChangeReflow();
   NS_IMETHOD GetPageSequenceFrame(nsIPageSequenceFrame** aResult) const;
   virtual NS_HIDDEN_(nsIFrame*) GetPrimaryFrameFor(nsIContent* aContent) const;
+  virtual NS_HIDDEN_(nsIFrame*) GetRealPrimaryFrameFor(nsIContent* aContent) const;
 
   NS_IMETHOD GetLayoutObjectFor(nsIContent*   aContent,
                                 nsISupports** aResult) const;
@@ -4786,6 +4787,15 @@ PresShell::GetPrimaryFrameFor(nsIContent* aContent) const
   return FrameManager()->GetPrimaryFrameFor(aContent, -1);
 }
 
+nsIFrame*
+PresShell::GetRealPrimaryFrameFor(nsIContent* aContent) const
+{
+  nsIFrame *primaryFrame = FrameManager()->GetPrimaryFrameFor(aContent, -1);
+  if (!primaryFrame)
+    return nsnull;
+  return nsPlaceholderFrame::GetRealFrameFor(primaryFrame);
+}
+
 NS_IMETHODIMP
 PresShell::GetLayoutObjectFor(nsIContent*   aContent,
                               nsISupports** aResult) const