diff --git a/content/events/src/nsEventStateManager.cpp b/content/events/src/nsEventStateManager.cpp
index c637787d58df..9d6aee861fca 100644
--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@@ -3231,6 +3231,11 @@ nsEventStateManager::ShiftFocusInternal(PRBool aForward, nsIContent* aStart)
         PRBool selectionWithFocus;
         MoveFocusToCaret(PR_FALSE, &selectionWithFocus);
         ignoreTabIndex = !selectionWithFocus;
+        // Refresh |selectionFrame| since MoveFocusToCaret() could have
+        // destroyed it. (bug 308086)
+        GetDocSelectionLocation(getter_AddRefs(selectionContent),
+                                getter_AddRefs(endSelectionContent),
+                                &selectionFrame, &selectionOffset);
       }
     }
   }