diff --git a/layout/forms/nsTextControlFrame.cpp b/layout/forms/nsTextControlFrame.cpp
index f97675e198ab..f4c89f642e02 100644
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -1102,7 +1102,7 @@ nsTextControlFrame::OffsetToDOMPoint(PRInt32 aOffset,
     } else {
       // Otherwise, set the selection on the textnode itself.
       NS_IF_ADDREF(*aResult = firstNode);
-      *aPosition = aOffset;
+      *aPosition = PR_MIN(aOffset, textLength);
     }
   } else {
     NS_IF_ADDREF(*aResult = rootNode);
diff --git a/layout/forms/test/Makefile.in b/layout/forms/test/Makefile.in
index 87db1547bc07..71ef092b496a 100644
--- a/layout/forms/test/Makefile.in
+++ b/layout/forms/test/Makefile.in
@@ -75,6 +75,7 @@ _TEST_FILES =	test_bug231389.html \
 		test_bug572406.html \
 		test_bug572649.html \
 		test_bug36619.html \
+		test_bug620936.html \
 		$(NULL)
 
 libs:: $(_TEST_FILES)
diff --git a/layout/forms/test/test_bug620936.html b/layout/forms/test/test_bug620936.html
new file mode 100644
index 000000000000..756fe46c4b7a
--- /dev/null
+++ b/layout/forms/test/test_bug620936.html
@@ -0,0 +1,36 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=620936
+-->
+<head>
+  <title>Test for Bug 620936</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=620936">Mozilla Bug 620936</a>
+<p id="display"></p>
+<div id="content">
+  <input value="foo">
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 620936 **/
+SimpleTest.waitForExplicitFinish();
+addLoadEvent(function() {
+  var i = document.querySelector("input");
+  i.focus();
+  i.setSelectionRange(100, 100);
+  is(i.selectionStart, 3, "The selection should be set to the end of the text");
+  is(i.selectionEnd, 3, "The selection should be set to the end of the text");
+  SimpleTest.finish();
+});
+
+</script>
+</pre>
+</body>
+</html>
