diff --git a/content/html/content/src/nsTextEditorState.cpp b/content/html/content/src/nsTextEditorState.cpp
index b1a81b0aed36..2ddc001b0b19 100644
--- a/content/html/content/src/nsTextEditorState.cpp
+++ b/content/html/content/src/nsTextEditorState.cpp
@@ -1726,8 +1726,14 @@ nsTextEditorState::SetValue(const nsAString& aValue, PRBool aUserInput)
           plaintextEditor->InsertText(insertValue);
         }
         if (!weakFrame.IsAlive()) {
-          NS_ASSERTION(!mBoundFrame, "The frame should have been unbounded");
-          SetValue(newValue, PR_FALSE);
+          // If the frame was destroyed because of a flush somewhere inside
+          // InsertText, mBoundFrame here will be false.  But it's also possible
+          // for the frame to go away because of another reason (such as deleting
+          // the existing selection -- see bug 574558), in which case we don't
+          // need to reset the value here.
+          if (!mBoundFrame) {
+            SetValue(newValue, PR_FALSE);
+          }
           valueSetter.Cancel();
           return;
         }