diff --git a/layout/generic/nsBlockFrame.cpp b/layout/generic/nsBlockFrame.cpp
index e6cbfa9a67ef..7f5997d4c3a1 100644
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -2511,12 +2511,33 @@ nsBlockFrame::UpdateBulletPosition(nsBlockReflowState& aState)
     if (mBullet && HaveOutsideBullet()) {
       // We now have an inside bullet, but used to have an outside
       // bullet.  Adjust the frame line list
-      nsLineBox* line = aState.NewLineBox(mBullet, 1, PR_FALSE);
-      if (!line) {
-        return NS_ERROR_OUT_OF_MEMORY;
+      if (mLines) {
+        // if we have a line already, then move the bullet to the front of the
+        // first line
+        nsIFrame* child = nsnull;
+        
+#ifdef DEBUG
+        // bullet should not have any siblings if it was an outside bullet
+        nsIFrame* next = nsnull;
+        mBullet->GetNextSibling(&next);
+        NS_ASSERTION(!next, "outside bullet should not have siblings");
+#endif
+        // move bullet to front and chain the previous frames, and update the line count
+        child = mLines->mFirstChild;
+        mLines->mFirstChild = mBullet;
+        mBullet->SetNextSibling(child);
+        PRInt32 count = mLines->GetChildCount();
+        mLines->SetChildCount(count+1);
+        // dirty it here in case the caller does not
+        mLines->MarkDirty();
+      } else {
+        // no prior lines, just create a new line for the bullet
+        nsLineBox* line = aState.NewLineBox(mBullet, 1, PR_FALSE);
+        if (!line) {
+          return NS_ERROR_OUT_OF_MEMORY;
+        }
+        mLines = line;
       }
-      line->mNext = mLines;
-      mLines = line;
     }
     mState &= ~NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET;
   }
diff --git a/layout/generic/nsBlockReflowState.cpp b/layout/generic/nsBlockReflowState.cpp
index e6cbfa9a67ef..7f5997d4c3a1 100644
--- a/layout/generic/nsBlockReflowState.cpp
+++ b/layout/generic/nsBlockReflowState.cpp
@@ -2511,12 +2511,33 @@ nsBlockFrame::UpdateBulletPosition(nsBlockReflowState& aState)
     if (mBullet && HaveOutsideBullet()) {
       // We now have an inside bullet, but used to have an outside
       // bullet.  Adjust the frame line list
-      nsLineBox* line = aState.NewLineBox(mBullet, 1, PR_FALSE);
-      if (!line) {
-        return NS_ERROR_OUT_OF_MEMORY;
+      if (mLines) {
+        // if we have a line already, then move the bullet to the front of the
+        // first line
+        nsIFrame* child = nsnull;
+        
+#ifdef DEBUG
+        // bullet should not have any siblings if it was an outside bullet
+        nsIFrame* next = nsnull;
+        mBullet->GetNextSibling(&next);
+        NS_ASSERTION(!next, "outside bullet should not have siblings");
+#endif
+        // move bullet to front and chain the previous frames, and update the line count
+        child = mLines->mFirstChild;
+        mLines->mFirstChild = mBullet;
+        mBullet->SetNextSibling(child);
+        PRInt32 count = mLines->GetChildCount();
+        mLines->SetChildCount(count+1);
+        // dirty it here in case the caller does not
+        mLines->MarkDirty();
+      } else {
+        // no prior lines, just create a new line for the bullet
+        nsLineBox* line = aState.NewLineBox(mBullet, 1, PR_FALSE);
+        if (!line) {
+          return NS_ERROR_OUT_OF_MEMORY;
+        }
+        mLines = line;
       }
-      line->mNext = mLines;
-      mLines = line;
     }
     mState &= ~NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET;
   }
diff --git a/layout/generic/nsBlockReflowState.h b/layout/generic/nsBlockReflowState.h
index e6cbfa9a67ef..7f5997d4c3a1 100644
--- a/layout/generic/nsBlockReflowState.h
+++ b/layout/generic/nsBlockReflowState.h
@@ -2511,12 +2511,33 @@ nsBlockFrame::UpdateBulletPosition(nsBlockReflowState& aState)
     if (mBullet && HaveOutsideBullet()) {
       // We now have an inside bullet, but used to have an outside
       // bullet.  Adjust the frame line list
-      nsLineBox* line = aState.NewLineBox(mBullet, 1, PR_FALSE);
-      if (!line) {
-        return NS_ERROR_OUT_OF_MEMORY;
+      if (mLines) {
+        // if we have a line already, then move the bullet to the front of the
+        // first line
+        nsIFrame* child = nsnull;
+        
+#ifdef DEBUG
+        // bullet should not have any siblings if it was an outside bullet
+        nsIFrame* next = nsnull;
+        mBullet->GetNextSibling(&next);
+        NS_ASSERTION(!next, "outside bullet should not have siblings");
+#endif
+        // move bullet to front and chain the previous frames, and update the line count
+        child = mLines->mFirstChild;
+        mLines->mFirstChild = mBullet;
+        mBullet->SetNextSibling(child);
+        PRInt32 count = mLines->GetChildCount();
+        mLines->SetChildCount(count+1);
+        // dirty it here in case the caller does not
+        mLines->MarkDirty();
+      } else {
+        // no prior lines, just create a new line for the bullet
+        nsLineBox* line = aState.NewLineBox(mBullet, 1, PR_FALSE);
+        if (!line) {
+          return NS_ERROR_OUT_OF_MEMORY;
+        }
+        mLines = line;
       }
-      line->mNext = mLines;
-      mLines = line;
     }
     mState &= ~NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET;
   }
diff --git a/layout/html/base/src/nsBlockFrame.cpp b/layout/html/base/src/nsBlockFrame.cpp
index e6cbfa9a67ef..7f5997d4c3a1 100644
--- a/layout/html/base/src/nsBlockFrame.cpp
+++ b/layout/html/base/src/nsBlockFrame.cpp
@@ -2511,12 +2511,33 @@ nsBlockFrame::UpdateBulletPosition(nsBlockReflowState& aState)
     if (mBullet && HaveOutsideBullet()) {
       // We now have an inside bullet, but used to have an outside
       // bullet.  Adjust the frame line list
-      nsLineBox* line = aState.NewLineBox(mBullet, 1, PR_FALSE);
-      if (!line) {
-        return NS_ERROR_OUT_OF_MEMORY;
+      if (mLines) {
+        // if we have a line already, then move the bullet to the front of the
+        // first line
+        nsIFrame* child = nsnull;
+        
+#ifdef DEBUG
+        // bullet should not have any siblings if it was an outside bullet
+        nsIFrame* next = nsnull;
+        mBullet->GetNextSibling(&next);
+        NS_ASSERTION(!next, "outside bullet should not have siblings");
+#endif
+        // move bullet to front and chain the previous frames, and update the line count
+        child = mLines->mFirstChild;
+        mLines->mFirstChild = mBullet;
+        mBullet->SetNextSibling(child);
+        PRInt32 count = mLines->GetChildCount();
+        mLines->SetChildCount(count+1);
+        // dirty it here in case the caller does not
+        mLines->MarkDirty();
+      } else {
+        // no prior lines, just create a new line for the bullet
+        nsLineBox* line = aState.NewLineBox(mBullet, 1, PR_FALSE);
+        if (!line) {
+          return NS_ERROR_OUT_OF_MEMORY;
+        }
+        mLines = line;
       }
-      line->mNext = mLines;
-      mLines = line;
     }
     mState &= ~NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET;
   }
diff --git a/layout/html/base/src/nsBlockReflowState.cpp b/layout/html/base/src/nsBlockReflowState.cpp
index e6cbfa9a67ef..7f5997d4c3a1 100644
--- a/layout/html/base/src/nsBlockReflowState.cpp
+++ b/layout/html/base/src/nsBlockReflowState.cpp
@@ -2511,12 +2511,33 @@ nsBlockFrame::UpdateBulletPosition(nsBlockReflowState& aState)
     if (mBullet && HaveOutsideBullet()) {
       // We now have an inside bullet, but used to have an outside
       // bullet.  Adjust the frame line list
-      nsLineBox* line = aState.NewLineBox(mBullet, 1, PR_FALSE);
-      if (!line) {
-        return NS_ERROR_OUT_OF_MEMORY;
+      if (mLines) {
+        // if we have a line already, then move the bullet to the front of the
+        // first line
+        nsIFrame* child = nsnull;
+        
+#ifdef DEBUG
+        // bullet should not have any siblings if it was an outside bullet
+        nsIFrame* next = nsnull;
+        mBullet->GetNextSibling(&next);
+        NS_ASSERTION(!next, "outside bullet should not have siblings");
+#endif
+        // move bullet to front and chain the previous frames, and update the line count
+        child = mLines->mFirstChild;
+        mLines->mFirstChild = mBullet;
+        mBullet->SetNextSibling(child);
+        PRInt32 count = mLines->GetChildCount();
+        mLines->SetChildCount(count+1);
+        // dirty it here in case the caller does not
+        mLines->MarkDirty();
+      } else {
+        // no prior lines, just create a new line for the bullet
+        nsLineBox* line = aState.NewLineBox(mBullet, 1, PR_FALSE);
+        if (!line) {
+          return NS_ERROR_OUT_OF_MEMORY;
+        }
+        mLines = line;
       }
-      line->mNext = mLines;
-      mLines = line;
     }
     mState &= ~NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET;
   }
diff --git a/layout/html/base/src/nsBlockReflowState.h b/layout/html/base/src/nsBlockReflowState.h
index e6cbfa9a67ef..7f5997d4c3a1 100644
--- a/layout/html/base/src/nsBlockReflowState.h
+++ b/layout/html/base/src/nsBlockReflowState.h
@@ -2511,12 +2511,33 @@ nsBlockFrame::UpdateBulletPosition(nsBlockReflowState& aState)
     if (mBullet && HaveOutsideBullet()) {
       // We now have an inside bullet, but used to have an outside
       // bullet.  Adjust the frame line list
-      nsLineBox* line = aState.NewLineBox(mBullet, 1, PR_FALSE);
-      if (!line) {
-        return NS_ERROR_OUT_OF_MEMORY;
+      if (mLines) {
+        // if we have a line already, then move the bullet to the front of the
+        // first line
+        nsIFrame* child = nsnull;
+        
+#ifdef DEBUG
+        // bullet should not have any siblings if it was an outside bullet
+        nsIFrame* next = nsnull;
+        mBullet->GetNextSibling(&next);
+        NS_ASSERTION(!next, "outside bullet should not have siblings");
+#endif
+        // move bullet to front and chain the previous frames, and update the line count
+        child = mLines->mFirstChild;
+        mLines->mFirstChild = mBullet;
+        mBullet->SetNextSibling(child);
+        PRInt32 count = mLines->GetChildCount();
+        mLines->SetChildCount(count+1);
+        // dirty it here in case the caller does not
+        mLines->MarkDirty();
+      } else {
+        // no prior lines, just create a new line for the bullet
+        nsLineBox* line = aState.NewLineBox(mBullet, 1, PR_FALSE);
+        if (!line) {
+          return NS_ERROR_OUT_OF_MEMORY;
+        }
+        mLines = line;
       }
-      line->mNext = mLines;
-      mLines = line;
     }
     mState &= ~NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET;
   }