Index: user/src/com/google/gwt/http/client/XMLHTTPRequest.java
===================================================================
--- user/src/com/google/gwt/http/client/XMLHTTPRequest.java	(revision 2558)
+++ user/src/com/google/gwt/http/client/XMLHTTPRequest.java	(working copy)
@@ -23,20 +23,30 @@
  */
 final class XMLHTTPRequest {
 
+  /*
+   * NOTE: Testing discovered that for some bizarre reason, on Mozilla, the
+   * JavaScript <code>XmlHttpRequest.onreadystatechange</code> handler
+   * function maybe still be called after it is deleted. The theory is that the
+   * callback is cached somewhere. Setting it to null or an empty function does
+   * seem to work properly, though.
+   * 
+   * On IE, there are two problems: Setting onreadystatechange to null (as
+   * opposed to an empty function) sometimes throws an exception. With
+   * particular (rare) versions of jscript.dll, setting onreadystatechange from
+   * within onreadystatechange causes a crash. Setting it from within a timeout
+   * fixes this bug (see issue 1610).
+   * 
+   * End result: *always* set onreadystatechange to an empty function (never to
+   * null). Never set onreadystatechange from within onreadystatechange (always
+   * in a setTimeout()).
+   */
+
   public static final int UNITIALIZED = 0;
   public static final int OPEN = 1;
   public static final int SENT = 2;
   public static final int RECEIVING = 3;
   public static final int LOADED = 4;
 
-  /*
-   * NOTE: Testing discovered that for some bizarre reason, on Mozilla, the
-   * JavaScript <code>XmlHttpRequest.onreadystatechange</code> handler function 
-   * maybe still be called after it is deleted. The theory is that the callback 
-   * is cached somewhere.  Setting the handler to null has the desired effect on 
-   * Mozilla but it causes IE to crash during the assignment. The solution is to
-   * set it to an empty function.
-   */
   static native void abort(JavaScriptObject xmlHttpRequest) /*-{
     xmlHttpRequest.onreadystatechange = @com.google.gwt.user.client.impl.HTTPRequestImpl::nullFunc;
     xmlHttpRequest.abort();
@@ -236,7 +246,9 @@
       String requestData, RequestCallback callback) /*-{
     xmlHttpRequest.onreadystatechange = function() {
       if (xmlHttpRequest.readyState == @com.google.gwt.http.client.XMLHTTPRequest::LOADED) {
-        xmlHttpRequest.onreadystatechange = @com.google.gwt.user.client.impl.HTTPRequestImpl::nullFunc;
+      	$wnd.setTimeout(function() {
+          xmlHttpRequest.onreadystatechange = @com.google.gwt.user.client.impl.HTTPRequestImpl::nullFunc;
+      	}, 0);
         httpRequest.@com.google.gwt.http.client.Request::fireOnResponseReceived(Lcom/google/gwt/http/client/RequestCallback;)(callback);
       }
     };
Index: user/src/com/google/gwt/xml/client/impl/XMLParserImplIE6.java
===================================================================
--- user/src/com/google/gwt/xml/client/impl/XMLParserImplIE6.java	(revision 2558)
+++ user/src/com/google/gwt/xml/client/impl/XMLParserImplIE6.java	(working copy)
@@ -24,7 +24,7 @@
 
   @Override
   protected native JavaScriptObject createDocumentImpl() /*-{
-    var doc = new ActiveXObject("MSXML2.DOMDocument");
+    var doc = new ActiveXObject("Microsoft.DOMDocument");
     doc.preserveWhiteSpace = true;
     doc.setProperty("SelectionNamespaces", "xmlns:xsl='http://www.w3.org/1999/XSL/Transform'");
     doc.setProperty("SelectionLanguage", "XPath");
Index: user/src/com/google/gwt/user/client/impl/HTTPRequestImpl.java
===================================================================
--- user/src/com/google/gwt/user/client/impl/HTTPRequestImpl.java	(revision 2558)
+++ user/src/com/google/gwt/user/client/impl/HTTPRequestImpl.java	(working copy)
@@ -68,7 +68,9 @@
       xmlHttp.setRequestHeader("Content-Type", "text/plain; charset=utf-8");
       xmlHttp.onreadystatechange = function() {
         if (xmlHttp.readyState == 4) {
-          xmlHttp.onreadystatechange = @com.google.gwt.user.client.impl.HTTPRequestImpl::nullFunc;
+        	$wnd.setTimeout(function() {
+            xmlHttp.onreadystatechange = @com.google.gwt.user.client.impl.HTTPRequestImpl::nullFunc;
+        	}, 0);
           handler.@com.google.gwt.user.client.ResponseTextHandler::onCompletion(Ljava/lang/String;)(xmlHttp.responseText || "");
         }
       };
@@ -88,7 +90,9 @@
       xmlHttp.setRequestHeader("Content-Type", "text/plain; charset=utf-8");
       xmlHttp.onreadystatechange = function() {
         if (xmlHttp.readyState == 4) {
-          xmlHttp.onreadystatechange = @com.google.gwt.user.client.impl.HTTPRequestImpl::nullFunc;
+        	$wnd.setTimeout(function() {
+            xmlHttp.onreadystatechange = @com.google.gwt.user.client.impl.HTTPRequestImpl::nullFunc;
+        	}, 0);
           handler.@com.google.gwt.user.client.ResponseTextHandler::onCompletion(Ljava/lang/String;)(xmlHttp.responseText || "");
         }
       };
Index: user/src/com/google/gwt/user/client/impl/HTTPRequestImplIE6.java
===================================================================
--- user/src/com/google/gwt/user/client/impl/HTTPRequestImplIE6.java	(revision 2558)
+++ user/src/com/google/gwt/user/client/impl/HTTPRequestImplIE6.java	(working copy)
@@ -25,6 +25,6 @@
 
   @Override
   protected native JavaScriptObject doCreateXmlHTTPRequest() /*-{
-    return new ActiveXObject("Msxml2.XMLHTTP");
+    return new ActiveXObject("Microsoft.XMLHTTP");
   }-*/;
 }
