diff --git a/editor/libeditor/html/crashtests/766795.html b/editor/libeditor/html/crashtests/766795.html
new file mode 100644
index 000000000000..b4ade3020947
--- /dev/null
+++ b/editor/libeditor/html/crashtests/766795.html
@@ -0,0 +1,21 @@
+
+
+
+
+
+
+
diff --git a/editor/libeditor/html/crashtests/crashtests.list b/editor/libeditor/html/crashtests/crashtests.list
index 00dc59f981e0..365a1e04e1d8 100644
--- a/editor/libeditor/html/crashtests/crashtests.list
+++ b/editor/libeditor/html/crashtests/crashtests.list
@@ -28,5 +28,6 @@ load 682650-1.html
load 716456-1.html
load 759748.html
load 761861.html
+load 766795.html
load 766305.html
load 766387.html
diff --git a/editor/libeditor/html/nsHTMLAnonymousUtils.cpp b/editor/libeditor/html/nsHTMLAnonymousUtils.cpp
index b6943686807e..6fa3f290a493 100644
--- a/editor/libeditor/html/nsHTMLAnonymousUtils.cpp
+++ b/editor/libeditor/html/nsHTMLAnonymousUtils.cpp
@@ -254,6 +254,13 @@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons(nsISelection * aSelection)
NS_ENSURE_TRUE(focusElement, NS_OK);
NS_ENSURE_SUCCESS(res, res);
+ // If we're not in a document, don't try to add resizers
+ nsCOMPtr focusElementNode = do_QueryInterface(focusElement);
+ NS_ENSURE_STATE(focusElementNode);
+ if (!focusElementNode->IsInDoc()) {
+ return NS_OK;
+ }
+
// what's its tag?
nsAutoString focusTagName;
res = focusElement->GetTagName(focusTagName);
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 8919e6d09f99..56f8289b8629 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -4080,9 +4080,10 @@ PresShell::ContentRemoved(nsIDocument *aDocument,
oldNextSibling = nsnull;
}
- if (aContainer)
+ if (aContainer && aContainer->IsElement()) {
mFrameConstructor->RestyleForRemove(aContainer->AsElement(), aChild,
oldNextSibling);
+ }
bool didReconstruct;
mFrameConstructor->ContentRemoved(aContainer, aChild, oldNextSibling,