Bug 574558 - Part 3: Handle frame reconstruction duirng nsTextEditorState::SetValue gracefully; r=roc

content/html/content/src/nsTextEditorState.cpp

@@ -1726,8 +1726,14 @@ nsTextEditorState::SetValue(const nsAString& aValue, PRBool aUserInput)
           plaintextEditor->InsertText(insertValue);
         }
         if (!weakFrame.IsAlive()) {
-          NS_ASSERTION(!mBoundFrame, "The frame should have been unbounded");
-          SetValue(newValue, PR_FALSE);
+          // If the frame was destroyed because of a flush somewhere inside
+          // InsertText, mBoundFrame here will be false.  But it's also possible
+          // for the frame to go away because of another reason (such as deleting
+          // the existing selection -- see bug 574558), in which case we don't
+          // need to reset the value here.
+          if (!mBoundFrame) {
+            SetValue(newValue, PR_FALSE);
+          }
           valueSetter.Cancel();
           return;
         }