diff --git a/content/base/src/nsContentIterator.cpp b/content/base/src/nsContentIterator.cpp
index 5486c2c1ee1..c2c2994cd97 100644
--- a/content/base/src/nsContentIterator.cpp
+++ b/content/base/src/nsContentIterator.cpp
@@ -22,7 +22,7 @@
  */
 
 #include "nsISupports.h"
-//#include "nsIEnumerator.h"
+#include "nsIDOMNodeList.h"
 #include "nsIContentIterator.h"
 #include "nsRange.h"
 #include "nsIContent.h"
@@ -33,6 +33,56 @@
 
 static NS_DEFINE_IID(kISupportsIID, NS_ISUPPORTS_IID);
 
+// couple of utility static functs
+
+///////////////////////////////////////////////////////////////////////////
+// GetNumChildren: returns the number of things inside aNode. 
+//
+static PRUint32
+GetNumChildren(nsIDOMNode *aNode) 
+{
+  PRUint32 numChildren = 0;
+  if (!aNode)
+    return 0;
+
+  PRBool hasChildNodes;
+  aNode->HasChildNodes(&hasChildNodes);
+  if (hasChildNodes)
+  {
+    nsCOMPtr<nsIDOMNodeList>nodeList;
+    nsresult res = aNode->GetChildNodes(getter_AddRefs(nodeList));
+    if (NS_SUCCEEDED(res) && nodeList) 
+      nodeList->GetLength(&numChildren);
+  }
+  return numChildren;
+}
+
+///////////////////////////////////////////////////////////////////////////
+// GetChildAt: returns the node at this position index in the parent
+//
+static nsCOMPtr<nsIDOMNode> 
+GetChildAt(nsIDOMNode *aParent, PRInt32 aOffset)
+{
+  nsCOMPtr<nsIDOMNode> resultNode;
+  
+  if (!aParent) 
+    return resultNode;
+  
+  PRBool hasChildNodes;
+  aParent->HasChildNodes(&hasChildNodes);
+  if (PR_TRUE==hasChildNodes)
+  {
+    nsCOMPtr<nsIDOMNodeList>nodeList;
+    nsresult res = aParent->GetChildNodes(getter_AddRefs(nodeList));
+    if (NS_SUCCEEDED(res) && nodeList) 
+      nodeList->Item(aOffset, getter_AddRefs(resultNode));
+  }
+  
+  return resultNode;
+}
+  
+
+
 
 /*
  *  A simple iterator class for traversing the content in "close tag" order
@@ -761,6 +811,7 @@ nsresult nsContentSubtreeIterator::Init(nsIDOMRange* aRange)
   nsCOMPtr<nsIContent> cN;
   nsCOMPtr<nsIContent> firstCandidate;
   nsCOMPtr<nsIContent> lastCandidate;
+  nsCOMPtr<nsIDOMNode> dChild;
   nsCOMPtr<nsIContent> cChild;
   PRInt32 indx, startIndx, endIndx;
   PRInt32 numChildren;
@@ -805,7 +856,7 @@ nsresult nsContentSubtreeIterator::Init(nsIDOMRange* aRange)
   
   // find first node in range
   aRange->GetStartOffset(&indx);
-  cStartP->ChildCount(numChildren);
+  numChildren = GetNumChildren(startParent);
   
   if (!numChildren) // no children, must be a text node
   {
@@ -813,7 +864,8 @@ nsresult nsContentSubtreeIterator::Init(nsIDOMRange* aRange)
   }
   else
   {
-    cStartP->ChildAt(indx,*getter_AddRefs(cChild));
+    dChild = GetChildAt(startParent, indx);
+    cChild = do_QueryInterface(dChild);
     if (!cChild)  // offset after last child
     {
       cN = cStartP;
@@ -859,13 +911,14 @@ nsresult nsContentSubtreeIterator::Init(nsIDOMRange* aRange)
   
   // now to find the last node
   aRange->GetEndOffset(&indx);
+  if (indx > numChildren) indx = numChildren;
   if (!indx)
   {
     cN = cEndP;
   }
   else
   {
-    cEndP->ChildCount(numChildren);
+    numChildren = GetNumChildren(endParent);
   
     if (!numChildren) // no children, must be a text node
     {
@@ -873,7 +926,8 @@ nsresult nsContentSubtreeIterator::Init(nsIDOMRange* aRange)
     }
     else
     {
-      cEndP->ChildAt(--indx,*getter_AddRefs(cChild));
+      dChild = GetChildAt(endParent, --indx);
+      cChild = do_QueryInterface(dChild);
       if (!cChild)  // shouldn't happen
       {
         NS_ASSERTION(0,"tree traversal trouble in nsContentSubtreeIterator::Init");
@@ -1020,5 +1074,3 @@ nsresult nsContentSubtreeIterator::GetTopAncestorInRange(
 }
 
 
-
-
diff --git a/layout/base/src/nsContentIterator.cpp b/layout/base/src/nsContentIterator.cpp
index 5486c2c1ee1..c2c2994cd97 100644
--- a/layout/base/src/nsContentIterator.cpp
+++ b/layout/base/src/nsContentIterator.cpp
@@ -22,7 +22,7 @@
  */
 
 #include "nsISupports.h"
-//#include "nsIEnumerator.h"
+#include "nsIDOMNodeList.h"
 #include "nsIContentIterator.h"
 #include "nsRange.h"
 #include "nsIContent.h"
@@ -33,6 +33,56 @@
 
 static NS_DEFINE_IID(kISupportsIID, NS_ISUPPORTS_IID);
 
+// couple of utility static functs
+
+///////////////////////////////////////////////////////////////////////////
+// GetNumChildren: returns the number of things inside aNode. 
+//
+static PRUint32
+GetNumChildren(nsIDOMNode *aNode) 
+{
+  PRUint32 numChildren = 0;
+  if (!aNode)
+    return 0;
+
+  PRBool hasChildNodes;
+  aNode->HasChildNodes(&hasChildNodes);
+  if (hasChildNodes)
+  {
+    nsCOMPtr<nsIDOMNodeList>nodeList;
+    nsresult res = aNode->GetChildNodes(getter_AddRefs(nodeList));
+    if (NS_SUCCEEDED(res) && nodeList) 
+      nodeList->GetLength(&numChildren);
+  }
+  return numChildren;
+}
+
+///////////////////////////////////////////////////////////////////////////
+// GetChildAt: returns the node at this position index in the parent
+//
+static nsCOMPtr<nsIDOMNode> 
+GetChildAt(nsIDOMNode *aParent, PRInt32 aOffset)
+{
+  nsCOMPtr<nsIDOMNode> resultNode;
+  
+  if (!aParent) 
+    return resultNode;
+  
+  PRBool hasChildNodes;
+  aParent->HasChildNodes(&hasChildNodes);
+  if (PR_TRUE==hasChildNodes)
+  {
+    nsCOMPtr<nsIDOMNodeList>nodeList;
+    nsresult res = aParent->GetChildNodes(getter_AddRefs(nodeList));
+    if (NS_SUCCEEDED(res) && nodeList) 
+      nodeList->Item(aOffset, getter_AddRefs(resultNode));
+  }
+  
+  return resultNode;
+}
+  
+
+
 
 /*
  *  A simple iterator class for traversing the content in "close tag" order
@@ -761,6 +811,7 @@ nsresult nsContentSubtreeIterator::Init(nsIDOMRange* aRange)
   nsCOMPtr<nsIContent> cN;
   nsCOMPtr<nsIContent> firstCandidate;
   nsCOMPtr<nsIContent> lastCandidate;
+  nsCOMPtr<nsIDOMNode> dChild;
   nsCOMPtr<nsIContent> cChild;
   PRInt32 indx, startIndx, endIndx;
   PRInt32 numChildren;
@@ -805,7 +856,7 @@ nsresult nsContentSubtreeIterator::Init(nsIDOMRange* aRange)
   
   // find first node in range
   aRange->GetStartOffset(&indx);
-  cStartP->ChildCount(numChildren);
+  numChildren = GetNumChildren(startParent);
   
   if (!numChildren) // no children, must be a text node
   {
@@ -813,7 +864,8 @@ nsresult nsContentSubtreeIterator::Init(nsIDOMRange* aRange)
   }
   else
   {
-    cStartP->ChildAt(indx,*getter_AddRefs(cChild));
+    dChild = GetChildAt(startParent, indx);
+    cChild = do_QueryInterface(dChild);
     if (!cChild)  // offset after last child
     {
       cN = cStartP;
@@ -859,13 +911,14 @@ nsresult nsContentSubtreeIterator::Init(nsIDOMRange* aRange)
   
   // now to find the last node
   aRange->GetEndOffset(&indx);
+  if (indx > numChildren) indx = numChildren;
   if (!indx)
   {
     cN = cEndP;
   }
   else
   {
-    cEndP->ChildCount(numChildren);
+    numChildren = GetNumChildren(endParent);
   
     if (!numChildren) // no children, must be a text node
     {
@@ -873,7 +926,8 @@ nsresult nsContentSubtreeIterator::Init(nsIDOMRange* aRange)
     }
     else
     {
-      cEndP->ChildAt(--indx,*getter_AddRefs(cChild));
+      dChild = GetChildAt(endParent, --indx);
+      cChild = do_QueryInterface(dChild);
       if (!cChild)  // shouldn't happen
       {
         NS_ASSERTION(0,"tree traversal trouble in nsContentSubtreeIterator::Init");
@@ -1020,5 +1074,3 @@ nsresult nsContentSubtreeIterator::GetTopAncestorInRange(
 }
 
 
-
-