diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index bcc25277f6c3..cc6a27021638 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -2977,6 +2977,13 @@ nsCSSFrameConstructor::ConstructTableForeignFrame(nsIPresShell*            aPres
 
   if (!parentFrame) return rv; // if pseudo frame wasn't created
 
+  NS_ASSERTION(parentFrame == aState.mPseudoFrames.mCellInner.mFrame,
+               "Weird parent in ConstructTableForeignFrame");
+
+  // Push the parent as the floater containing block
+  nsFrameConstructorSaveState saveState;
+  aState.PushFloatContainingBlock(parentFrame, saveState, PR_FALSE, PR_FALSE);
+  
   // save the pseudo frame state XXX - why
   nsPseudoFrames prevPseudoFrames; 
   aState.mPseudoFrames.Reset(&prevPseudoFrames);
@@ -6061,6 +6068,17 @@ nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell*            aPre
     }
   }
 
+  nsFrameConstructorSaveState pseudoSaveState;
+  if (pseudoParent) {
+    // We pushed an anonymous table cell.  The inner block of this
+    // needs to become the float containing block.  Luckily, it's
+    // hanging about in adjParentFrame!
+    NS_ASSERTION(adjParentFrame == aState.mPseudoFrames.mCellInner.mFrame,
+                 "Weird parent frame in ConstructFrameByDisplayType");
+    aState.PushFloatContainingBlock(adjParentFrame, pseudoSaveState,
+                                    PR_FALSE, PR_FALSE);
+  }
+
   // If this is "body", try propagating its scroll style to the viewport
   // Note that we need to do this even if the body is NOT scrollable;
   // it might have dynamically changed from scrollable to not scrollable,
diff --git a/layout/html/style/src/nsCSSFrameConstructor.cpp b/layout/html/style/src/nsCSSFrameConstructor.cpp
index bcc25277f6c3..cc6a27021638 100644
--- a/layout/html/style/src/nsCSSFrameConstructor.cpp
+++ b/layout/html/style/src/nsCSSFrameConstructor.cpp
@@ -2977,6 +2977,13 @@ nsCSSFrameConstructor::ConstructTableForeignFrame(nsIPresShell*            aPres
 
   if (!parentFrame) return rv; // if pseudo frame wasn't created
 
+  NS_ASSERTION(parentFrame == aState.mPseudoFrames.mCellInner.mFrame,
+               "Weird parent in ConstructTableForeignFrame");
+
+  // Push the parent as the floater containing block
+  nsFrameConstructorSaveState saveState;
+  aState.PushFloatContainingBlock(parentFrame, saveState, PR_FALSE, PR_FALSE);
+  
   // save the pseudo frame state XXX - why
   nsPseudoFrames prevPseudoFrames; 
   aState.mPseudoFrames.Reset(&prevPseudoFrames);
@@ -6061,6 +6068,17 @@ nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell*            aPre
     }
   }
 
+  nsFrameConstructorSaveState pseudoSaveState;
+  if (pseudoParent) {
+    // We pushed an anonymous table cell.  The inner block of this
+    // needs to become the float containing block.  Luckily, it's
+    // hanging about in adjParentFrame!
+    NS_ASSERTION(adjParentFrame == aState.mPseudoFrames.mCellInner.mFrame,
+                 "Weird parent frame in ConstructFrameByDisplayType");
+    aState.PushFloatContainingBlock(adjParentFrame, pseudoSaveState,
+                                    PR_FALSE, PR_FALSE);
+  }
+
   // If this is "body", try propagating its scroll style to the viewport
   // Note that we need to do this even if the body is NOT scrollable;
   // it might have dynamically changed from scrollable to not scrollable,