diff --git a/layout/base/nsPresState.cpp b/layout/base/nsPresState.cpp
index 4a855287f0b7..0bb819d8cdd3 100644
--- a/layout/base/nsPresState.cpp
+++ b/layout/base/nsPresState.cpp
@@ -49,7 +49,6 @@
 #include "nsLayoutErrors.h"
 #include "nsPresState.h"
 #include "nsString.h"
-
 // Implementation /////////////////////////////////////////////////////////////////
 
 nsresult
@@ -121,6 +120,29 @@ nsPresState::SetStatePropertyAsSupports(const nsAString& aName,
   return NS_OK;
 }
 
+nsresult
+nsPresState::SetScrollState(const nsRect& aRect)
+{
+  if (!mScrollState) {
+    mScrollState = new nsRect();
+    if (!mScrollState)
+      return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  *mScrollState = aRect;
+  return NS_OK;
+}
+
+nsRect
+nsPresState::GetScrollState()
+{
+  if (!mScrollState) {
+    nsRect empty(0,0,0,0);
+    return empty;  
+  }
+
+  return *mScrollState;
+}
 
 nsresult
 NS_NewPresState(nsPresState** aState)
diff --git a/layout/base/nsPresState.h b/layout/base/nsPresState.h
index 0c026436435f..658413d74fea 100755
--- a/layout/base/nsPresState.h
+++ b/layout/base/nsPresState.h
@@ -43,8 +43,12 @@
 #ifndef nsPresState_h_
 #define nsPresState_h_
 
+#include "prtypes.h"
 #include "nsStringFwd.h"
 #include "nsInterfaceHashtable.h"
+#include "nsPoint.h"
+#include "nsAutoPtr.h"
+#include "nsRect.h"
 
 class nsPresState
 {
@@ -65,12 +69,16 @@ public:
 
   NS_HIDDEN_(nsresult) RemoveStateProperty(const nsAString& aProperty);
 
+  NS_HIDDEN_(nsresult) SetScrollState(const nsRect& aState);
+
+  nsRect GetScrollState();
+
 // MEMBER VARIABLES
 protected:
-  // A string table that holds property/value pairs.
   nsInterfaceHashtable<nsStringHashKey,nsISupports> mPropertyTable;
+  nsAutoPtr<nsRect> mScrollState;
 };
 
 NS_HIDDEN_(nsresult) NS_NewPresState(nsPresState **aState);
 
-#endif
+#endif /* nsPresState_h_ */
diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index 17be6ab66b4d..ff1eb0c3dfae 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -2712,76 +2712,28 @@ nsGfxScrollFrameInner::SaveState(nsIStatefulFrame::SpecialStateID aStateID)
   }
 
   nsRect childRect = child->GetBounds();
+  childRect.x = x;
+  childRect.y = y;
   nsAutoPtr<nsPresState> state;
   nsresult rv = NS_NewPresState(getter_Transfers(state));
   NS_ENSURE_SUCCESS(rv, nsnull);
 
-  nsCOMPtr<nsISupportsPRInt32> xoffset = do_CreateInstance(NS_SUPPORTS_PRINT32_CONTRACTID);
-  if (xoffset) {
-    rv = xoffset->SetData(x);
-    NS_ENSURE_SUCCESS(rv, nsnull);
-    state->SetStatePropertyAsSupports(NS_LITERAL_STRING("x-offset"), xoffset);
-  }
+  state->SetScrollState(childRect);
 
-  nsCOMPtr<nsISupportsPRInt32> yoffset = do_CreateInstance(NS_SUPPORTS_PRINT32_CONTRACTID);
-  if (yoffset) {
-    rv = yoffset->SetData(y);
-    NS_ENSURE_SUCCESS(rv, nsnull);
-    state->SetStatePropertyAsSupports(NS_LITERAL_STRING("y-offset"), yoffset);
-  }
-
-  nsCOMPtr<nsISupportsPRInt32> width = do_CreateInstance(NS_SUPPORTS_PRINT32_CONTRACTID);
-  if (width) {
-    rv = width->SetData(childRect.width);
-    NS_ENSURE_SUCCESS(rv, nsnull);
-    state->SetStatePropertyAsSupports(NS_LITERAL_STRING("width"), width);
-  }
-
-  nsCOMPtr<nsISupportsPRInt32> height = do_CreateInstance(NS_SUPPORTS_PRINT32_CONTRACTID);
-  if (height) {
-    rv = height->SetData(childRect.height);
-    NS_ENSURE_SUCCESS(rv, nsnull);
-    state->SetStatePropertyAsSupports(NS_LITERAL_STRING("height"), height);
-  }
   return state.forget();
 }
 
 void
 nsGfxScrollFrameInner::RestoreState(nsPresState* aState)
 {
-  nsCOMPtr<nsISupportsPRInt32> xoffset;
-  nsCOMPtr<nsISupportsPRInt32> yoffset;
-  nsCOMPtr<nsISupportsPRInt32> width;
-  nsCOMPtr<nsISupportsPRInt32> height;
-  aState->GetStatePropertyAsSupports(NS_LITERAL_STRING("x-offset"), getter_AddRefs(xoffset));
-  aState->GetStatePropertyAsSupports(NS_LITERAL_STRING("y-offset"), getter_AddRefs(yoffset));
-  aState->GetStatePropertyAsSupports(NS_LITERAL_STRING("width"), getter_AddRefs(width));
-  aState->GetStatePropertyAsSupports(NS_LITERAL_STRING("height"), getter_AddRefs(height));
-
-  if (xoffset && yoffset) {
-    PRInt32 x,y,w,h;
-    nsresult rv = xoffset->GetData(&x);
-    if (NS_SUCCEEDED(rv))
-      rv = yoffset->GetData(&y);
-    if (NS_SUCCEEDED(rv))
-      rv = width->GetData(&w);
-    if (NS_SUCCEEDED(rv))
-      rv = height->GetData(&h);
-
-    mLastPos.x = -1;
-    mLastPos.y = -1;
-    mRestoreRect.SetRect(-1, -1, -1, -1);
-
-    // don't do it now, store it later and do it in layout.
-    if (NS_SUCCEEDED(rv)) {
-      mRestoreRect.SetRect(x, y, w, h);
-      mDidHistoryRestore = PR_TRUE;
-      nsIScrollableView* scrollingView = GetScrollableView();
-      if (scrollingView) {
-        scrollingView->GetScrollPosition(mLastPos.x, mLastPos.y);
-      } else {
-        mLastPos = nsPoint(0, 0);
-      }
-    }
+  mRestoreRect = aState->GetScrollState();
+  mLastPos.x = -1;
+  mLastPos.y = -1;
+  mDidHistoryRestore = PR_TRUE;
+  nsIScrollableView* scrollingView = GetScrollableView();
+  if (scrollingView) {
+    scrollingView->GetScrollPosition(mLastPos.x, mLastPos.y);
+  } else {
+    mLastPos = nsPoint(0, 0);
   }
 }
diff --git a/layout/xul/base/public/nsPIBoxObject.h b/layout/xul/base/public/nsPIBoxObject.h
index d428347b5f0f..8a394490f4e4 100644
--- a/layout/xul/base/public/nsPIBoxObject.h
+++ b/layout/xul/base/public/nsPIBoxObject.h
@@ -53,7 +53,7 @@ class nsPIBoxObject : public nsIBoxObject
 public:
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_PIBOXOBJECT_IID)
 
-  virtual void Init(nsIContent* aContent) = 0;
+  virtual nsresult Init(nsIContent* aContent) = 0;
 
   // Drop the weak ref to the content node as needed
   virtual void Clear() = 0;
diff --git a/layout/xul/base/src/nsBoxObject.cpp b/layout/xul/base/src/nsBoxObject.cpp
index 4556a1be65bb..361357b01cca 100644
--- a/layout/xul/base/src/nsBoxObject.cpp
+++ b/layout/xul/base/src/nsBoxObject.cpp
@@ -37,6 +37,7 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsBoxObject.h"
+#include "nsCOMPtr.h"
 #include "nsIDocument.h"
 #include "nsIPresShell.h"
 #include "nsPresContext.h"
@@ -54,6 +55,9 @@
 #include "nsIDOMXULElement.h"
 #include "nsIFrame.h"
 #include "nsLayoutUtils.h"
+#include "nsISupportsPrimitives.h"
+#include "prtypes.h"
+#include "nsSupportsPrimitives.h"
 
 // Static IIDs/CIDs. Try to minimize these.
 static NS_DEFINE_CID(kLookAndFeelCID, NS_LOOKANDFEEL_CID);
@@ -100,16 +104,17 @@ nsBoxObject::GetElement(nsIDOMElement** aResult)
 
 // nsPIBoxObject //////////////////////////////////////////////////////////////////////////
 
-void
+nsresult
 nsBoxObject::Init(nsIContent* aContent)
 {
   mContent = aContent;
+  return NS_OK;
 }
 
 void
 nsBoxObject::Clear()
 {
-  mPresState = nsnull;
+  mPropertyTable = nsnull;
   mContent = nsnull;
 }
 
@@ -346,13 +351,12 @@ NS_IMETHODIMP
 nsBoxObject::GetPropertyAsSupports(const PRUnichar* aPropertyName, nsISupports** aResult)
 {
   NS_ENSURE_ARG(aPropertyName && *aPropertyName);
-  if (!mPresState) {
+  if (!mPropertyTable) {
     *aResult = nsnull;
     return NS_OK;
   }
-
   nsDependentString propertyName(aPropertyName);
-  return mPresState->GetStatePropertyAsSupports(propertyName, aResult); // Addref here.
+  return mPropertyTable->Get(propertyName, aResult); // Addref here.
 }
 
 NS_IMETHODIMP
@@ -368,33 +372,36 @@ nsBoxObject::SetPropertyAsSupports(const PRUnichar* aPropertyName, nsISupports*
                  "exploit you");
   }
 #endif
-
   NS_ENSURE_ARG(aPropertyName && *aPropertyName);
   
-  if (!mPresState) {
-    NS_NewPresState(getter_Transfers(mPresState));
-    NS_ENSURE_TRUE(mPresState, NS_ERROR_OUT_OF_MEMORY);
+  if (!mPropertyTable) {  
+    mPropertyTable = new nsInterfaceHashtable<nsStringHashKey,nsISupports>;  
+    if (!mPropertyTable) return NS_ERROR_OUT_OF_MEMORY;
+    if (NS_FAILED(mPropertyTable->Init(8))) {
+       mPropertyTable = nsnull;
+       return NS_ERROR_FAILURE;
+    }
   }
 
   nsDependentString propertyName(aPropertyName);
-  return mPresState->SetStatePropertyAsSupports(propertyName, aValue);
+  return mPropertyTable->Put(propertyName, aValue);
 }
 
 NS_IMETHODIMP
 nsBoxObject::GetProperty(const PRUnichar* aPropertyName, PRUnichar** aResult)
 {
-  NS_ENSURE_ARG(aPropertyName && *aPropertyName);
-  
-  if (!mPresState) {
+  nsCOMPtr<nsISupports> data;
+  if (NS_FAILED(GetPropertyAsSupports(aPropertyName,getter_AddRefs(data)))) {
     *aResult = nsnull;
     return NS_OK;
   }
 
-  nsDependentString propertyName(aPropertyName);
-  nsAutoString result;
-  nsresult rv = mPresState->GetStateProperty(propertyName, result);
-  if (NS_FAILED(rv))
-    return rv;
+  nsCOMPtr<nsISupportsString> supportsStr = do_QueryInterface(data);
+  if (!supportsStr) 
+    return NS_ERROR_FAILURE;
+  nsAutoString result;  
+  supportsStr->GetData(result);
+
   *aResult = result.IsVoid() ? nsnull : ToNewUnicode(result);
   return NS_OK;
 }
@@ -403,10 +410,7 @@ NS_IMETHODIMP
 nsBoxObject::SetProperty(const PRUnichar* aPropertyName, const PRUnichar* aPropertyValue)
 {
   NS_ENSURE_ARG(aPropertyName && *aPropertyName);
-  if (!mPresState) {
-    NS_NewPresState(getter_Transfers(mPresState));
-    NS_ENSURE_TRUE(mPresState, NS_ERROR_OUT_OF_MEMORY);
-  }
+
   nsDependentString propertyName(aPropertyName);
   nsDependentString propertyValue;
   if (aPropertyValue) {
@@ -414,18 +418,24 @@ nsBoxObject::SetProperty(const PRUnichar* aPropertyName, const PRUnichar* aPrope
   } else {
     propertyValue.SetIsVoid(PR_TRUE);
   }
-  return mPresState->SetStateProperty(propertyName, propertyValue);
+  
+  nsCOMPtr<nsISupportsString> supportsStr(do_CreateInstance(NS_SUPPORTS_STRING_CONTRACTID));
+  NS_ENSURE_TRUE(supportsStr, NS_ERROR_OUT_OF_MEMORY);
+  supportsStr->SetData(propertyValue);
+
+  return SetPropertyAsSupports(aPropertyName,supportsStr);
 }
 
 NS_IMETHODIMP
 nsBoxObject::RemoveProperty(const PRUnichar* aPropertyName)
 {
   NS_ENSURE_ARG(aPropertyName && *aPropertyName);
-  if (!mPresState)
-    return NS_OK;
+
+  if (!mPropertyTable) return NS_OK;
 
   nsDependentString propertyName(aPropertyName);
-  return mPresState->RemoveStateProperty(propertyName);
+  mPropertyTable->Remove(propertyName);
+  return NS_OK;
 }
 
 NS_IMETHODIMP 
diff --git a/layout/xul/base/src/nsBoxObject.h b/layout/xul/base/src/nsBoxObject.h
index 5416b6c7050c..e0179aad4b63 100644
--- a/layout/xul/base/src/nsBoxObject.h
+++ b/layout/xul/base/src/nsBoxObject.h
@@ -35,12 +35,16 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
+#ifndef nsBoxObject_h_
+#define nsBoxObject_h_
+
 #include "nsCOMPtr.h"
 #include "nsIBoxObject.h"
 #include "nsPIBoxObject.h"
-#include "nsPresState.h"
 #include "nsPoint.h"
 #include "nsAutoPtr.h"
+#include "nsHashKeys.h"
+#include "nsInterfaceHashtable.h"
 
 class nsIFrame;
 class nsIDocShell;
@@ -56,7 +60,7 @@ public:
   virtual ~nsBoxObject();
 
   // nsPIBoxObject
-  virtual void Init(nsIContent* aContent);
+  virtual nsresult Init(nsIContent* aContent);
   virtual void Clear();
   virtual void ClearCachedValues();
 
@@ -72,7 +76,9 @@ public:
 
 protected:
 
-  nsAutoPtr<nsPresState> mPresState; // [OWNER]
+  nsAutoPtr<nsInterfaceHashtable<nsStringHashKey,nsISupports> > mPropertyTable; //[OWNER]
 
   nsIContent* mContent; // [WEAK]
 };
+
+#endif