diff --git a/dlls/mshtml/htmlstyle.c b/dlls/mshtml/htmlstyle.c
index c205d67ba02..aa065dd5457 100644
--- a/dlls/mshtml/htmlstyle.c
+++ b/dlls/mshtml/htmlstyle.c
@@ -858,9 +858,12 @@ static const style_tbl_entry_t *lookup_style_tbl(const WCHAR *name)
     return NULL;
 }
 
-static LPWSTR fix_px_value(LPCWSTR val)
+static void fix_px_value(nsAString *nsstr)
 {
-    LPCWSTR ptr = val;
+    const WCHAR *val, *ptr;
+
+    nsAString_GetData(nsstr, &val);
+    ptr = val;
 
     while(*ptr) {
         while(*ptr && isspaceW(*ptr))
@@ -884,14 +887,14 @@ static LPWSTR fix_px_value(LPCWSTR val)
 
             TRACE("fixed %s -> %s\n", debugstr_w(val), debugstr_w(ret));
 
-            return ret;
+            nsAString_SetData(nsstr, ret);
+            heap_free(ret);
+            break;
         }
 
         while(*ptr && !isspaceW(*ptr))
             ptr++;
     }
-
-    return NULL;
 }
 
 static LPWSTR fix_url_value(LPCWSTR val)
@@ -968,11 +971,12 @@ static HRESULT var_to_styleval(CSSStyle *style, const VARIANT *v, const style_tb
 static inline HRESULT set_style_property(CSSStyle *style, styleid_t sid, const WCHAR *value)
 {
     nsAString value_str;
+    unsigned flags = 0;
     WCHAR *val = NULL;
     HRESULT hres;
 
     if(value && *value && dispex_compat_mode(&style->dispex) < COMPAT_MODE_IE9) {
-        unsigned flags = style_tbl[sid].flags;
+        flags = style_tbl[sid].flags;
 
         if(style_tbl[sid].allowed_values) {
             const WCHAR **iter;
@@ -989,13 +993,13 @@ static inline HRESULT set_style_property(CSSStyle *style, styleid_t sid, const W
             }
         }
 
-        if(flags & ATTR_FIX_PX)
-            val = fix_px_value(value);
-        else if(flags & ATTR_FIX_URL)
+        if(flags & ATTR_FIX_URL)
             val = fix_url_value(value);
     }
 
     nsAString_InitDepend(&value_str, val ? val : value);
+    if(flags & ATTR_FIX_PX)
+        fix_px_value(&value_str);
     hres = set_nsstyle_property(style->nsstyle, sid, &value_str);
     nsAString_Finish(&value_str);
     heap_free(val);
diff --git a/dlls/mshtml/mshtml_private.h b/dlls/mshtml/mshtml_private.h
index fadea6b4d99..a44eaf59a11 100644
--- a/dlls/mshtml/mshtml_private.h
+++ b/dlls/mshtml/mshtml_private.h
@@ -968,6 +968,7 @@ void nsACString_Finish(nsACString*) DECLSPEC_HIDDEN;
 
 BOOL nsAString_Init(nsAString*,const PRUnichar*) DECLSPEC_HIDDEN;
 void nsAString_InitDepend(nsAString*,const PRUnichar*) DECLSPEC_HIDDEN;
+void nsAString_SetData(nsAString*,const PRUnichar*) DECLSPEC_HIDDEN;
 UINT32 nsAString_GetData(const nsAString*,const PRUnichar**) DECLSPEC_HIDDEN;
 void nsAString_Finish(nsAString*) DECLSPEC_HIDDEN;
 
diff --git a/dlls/mshtml/nsembed.c b/dlls/mshtml/nsembed.c
index 6aa2812a6d4..bcfc437c309 100644
--- a/dlls/mshtml/nsembed.c
+++ b/dlls/mshtml/nsembed.c
@@ -843,6 +843,11 @@ UINT32 nsAString_GetData(const nsAString *str, const PRUnichar **data)
     return NS_StringGetData(str, data, NULL);
 }
 
+void nsAString_SetData(nsAString *str, const PRUnichar *data)
+{
+    NS_StringSetData(str, data, PR_UINT32_MAX);
+}
+
 void nsAString_Finish(nsAString *str)
 {
     NS_StringContainerFinish(str);